Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,813 results · page 44 of 57

Mar 27, 2024WCFM – Frontend Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29929 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.7.8.
Product
WCFM – Frontend Manager for WooCommerce
Affected
up to 6.7.8
What to do
Affects up to 6.7.8. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Manager for Icomoon: Unrestricted Upload of File with Dangerous TypeCVE-2023-29386 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0.
Product
Manager for Icomoon
Affected
up to 2.0
What to do
Affects up to 2.0. Update Manager for Icomoon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28787 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.
Product
Quiz And Survey Master
Affected
up to 8.1.4
What to do
Affects up to 8.1.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-23991 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.
Product
Booking Calendar
Affected
up to 9.4.3
What to do
Affects up to 9.4.3. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
Product
CM Download Manager
Fixed in
2.9.1
What to do
Update CM Download Manager to 2.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1232 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
Product
CM Download Manager
Fixed in
2.9.0
What to do
Update CM Download Manager to 2.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1231 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
Product
CM Download Manager
Fixed in
2.9.0
What to do
Update CM Download Manager to 2.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2024Tracking Code Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2579 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.
Product
Tracking Code Manager
Affected
up to 2.0.16
What to do
Affects up to 2.0.16. Update Tracking Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-27956 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
Product
Automatic
Affected
up to 3.92.0
What to do
Affects up to 3.92.0. Update Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024File Manager: Cross-Site Request ForgeryCVE-2024-1538 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
Product
File Manager
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring: Arbitrary file uploadsCVE-2024-1205 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvello_upload_csv_file function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2024Permalink Manager Lite: Unauthorized modification of dataCVE-2024-2538 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.
Product
Permalink Manager Lite
Affected
up to 2.4.3.1
What to do
Affects up to 2.4.3.1. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Mar 19, 2024Permalink Manager Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29092 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.
Product
Permalink Manager Lite
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27998 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29124 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Stored XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooCommerce License Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29121 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firassaidi WooCommerce License Manager allows Reflected XSS.This issue affects WooCommerce License Manager: from n/a through 5.3.1.
Product
WooCommerce License Manager
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update WooCommerce License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29114 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84.
Product
Download Manager
Affected
up to 3.2.84
What to do
Affects up to 3.2.84. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooCommerce Google Feed Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29112 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marketing Robot WooCommerce Google Feed Manager allows Stored XSS.This issue affects WooCommerce Google Feed Manager: from n/a through 2.2.0.
Product
WooCommerce Google Feed Manager
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WooCommerce Google Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29127 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2024WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: from n/a through 4.2.9.
Product
WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management
Affected
up to 4.2.9
What to do
Affects up to 4.2.9. Update WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2024Frontend File Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a through 22.7.
Product
Frontend File Manager
Affected
up to 22.7
What to do
Affects up to 22.7. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 16, 2024Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates: Sensitive Information ExposureCVE-2024-1857 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.
Product
Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: Cross-Site Request ForgeryCVE-2024-1642 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.6.0.1
What to do
Affects up to 4.6.0.1. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: SQL InjectionCVE-2024-1203 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Reflected Cross-Site ScriptingCVE-2024-0976 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.41
What to do
Affects up to 3.1.41. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Events Manager: Stored Cross-Site ScriptingCVE-2024-0614 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Events Manager
Affected
up to 6.4.6.4
What to do
Affects up to 6.4.6.4. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Mar 13, 2024File Manager Pro: Reflected Cross-Site ScriptingCVE-2023-7015 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
File Manager Pro
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Mar 13, 2024Download Manager Pro: Stored Cross-Site ScriptingCVE-2023-6954 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager Pro
Affected
up to 3.2.85
What to do
Affects up to 3.2.85. Update Download Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) CVE-2023-6825 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_shortcode function. This makes it possible for attackers to read the contents of arbitrary files on the server, which can contain sensitive information and to upload files into directories other than the intended directory for file uploads. The free version requires Administrator access for this vulnerability to be exploitable. The Pro version allows a file manager to be embedded via a shortcode and also allows admins to grant file handling privileges to other user levels, which could lead to this vulnerability being exploited by lower-level users.
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 13, 2024Download Manager: Unauthorized file download of files addedCVE-2023-6785 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).
Product
Download Manager
Affected
up to 3.2.84
What to do
Affects up to 3.2.84. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2024SportsPress – Sports Club & League Manager: Unauthorized modification of dataCVE-2024-1178 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs
Product
SportsPress – Sports Club & League Manager
Affected
up to 2.7.17
What to do
Affects up to 2.7.17. Update SportsPress – Sports Club & League Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024A no-code page builder for beautiful performance-based content: Cross-Site Request Forgery (CSRF)CVE-2024-24701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code page builder for beautiful performance-based content: from n/a through 2.1.20.
Product
A no-code page builder for beautiful performance-based content
Affected
up to 2.1.20
What to do
Affects up to 2.1.20. Update A no-code page builder for beautiful performance-based content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024postMash – custom post order: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25927 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Joel Starnes postMash – custom post order.This issue affects postMash – custom post order: from n/a through 1.2.0.
Product
postMash – custom post order
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update postMash – custom post order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024MoveTo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25910 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
Product
MoveTo
Affected
up to 6.2
What to do
Affects up to 6.2. Update MoveTo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Malware Scanner: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25902 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2.
Product
Malware Scanner
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024SP Project & Document Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-24868 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
Product
SP Project & Document Manager
Affected
up to 4.69
What to do
Affects up to 4.69. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: Time-based SQL InjectionCVE-2024-0786 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ee_syncProductCategory function using the parameters conditionData, valueData, productArray, exclude and include in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 23, 2024Sitepact: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1.0.5.
Product
Sitepact
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Sitepact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Smart Manager
Fixed in
8.28.0
What to do
Update Smart Manager to 8.28.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 12, 2024Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently –: Deserialization of Untrusted DataCVE-2024-24796 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1.
Product
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently –
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 9, 2024Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin: Unauthorized access of dataCVE-2024-1122 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
Product
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin
Affected
up to 3.3.50
What to do
Affects up to 3.3.50. Update Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 8, 2024BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24834 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net allows Stored XSS.This issue affects BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.
Product
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024WP Club Manager – WordPress Sports Club: Unauthorized modification of dataCVE-2024-1177 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs
Product
WP Club Manager – WordPress Sports Club
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update WP Club Manager – WordPress Sports Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Affiliates Manager: Cross-Site Request ForgeryCVE-2024-0859 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the process_bulk_action function in ListAffiliatesTable.php. This makes it possible for unauthenticated attackers to delete affiliates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Affiliates Manager
Affected
up to 2.9.34
What to do
Affects up to 2.9.34. Update Affiliates Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Unauthorized access, modification or loss of dataCVE-2024-0791 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Cross-Site Request ForgeryCVE-2024-0790 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.1. This is due to missing or incorrect nonce validation on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenticated attackers to create, modify and delete taxonomy terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Furthermore, the functions wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta are vulnerable to Cross-Site Request Forgery allowing for plugin options update, post count deletion, post deletion and modification of post metadata via forged request.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024File Manager: Sensitive Information ExposureCVE-2024-0761 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
Product
File Manager
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 5, 2024Starbox – the Author Box for Humans: Insecure Direct Object ReferenceCVE-2024-0366 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This makes it possible for subscribers to view plugin preferences and potentially other user settings.
Product
Starbox – the Author Box for Humans
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Starbox – the Author Box for Humans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024File Manager Pro: Arbitrary File UploadCVE-2023-6846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.
Product
File Manager Pro
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordfence.com
Feb 5, 2024PT Sign Ups – Beautiful volunteer sign ups and management made easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a through 1.0.4.
Product
PT Sign Ups – Beautiful volunteer sign ups and management made easy
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update PT Sign Ups – Beautiful volunteer sign ups and management made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.