Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

24,771 results · page 440 of 496

Sep 25, 2023FileOrganizer: Does not restrict functionality on multisite instancesCVE-2023-3664 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
Product
FileOrganizer
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FileOrganizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023All in One B2B for WooCommerce: Does not properly check nonce values in several actionsCVE-2023-3547 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
Product
All in One B2B for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2023Easy Registration Forms: Information DisclosureCVE-2023-5134 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive user meta.
Product
Easy Registration Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Easy Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2023WP-Matomo Integration (WP-Piwik): Stored Cross-Site ScriptingCVE-2023-4774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Matomo Integration (WP-Piwik)
Affected
up to 1.0.28
What to do
Affects up to 1.0.28. Update WP-Matomo Integration (WP-Piwik) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2023Super Store Finder: Unauthenticated arbitrary email creation and relayCVE-2023-5054 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.
Product
Super Store Finder
Affected
up to 6.9.3
What to do
Affects up to 6.9.3. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record superstorefinder.net superstorefinder.net
Sep 15, 2023Allow PHP in Posts and Pages: Remote Code ExecutionCVE-2023-4994 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.
Product
Allow PHP in Posts and Pages
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Allow PHP in Posts and Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 14, 2023WooCommerce CVR Payment Gateway: Unauthorized modification of dataCVE-2023-4948 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update CVR numbers for orders.
Product
WooCommerce CVR Payment Gateway
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update WooCommerce CVR Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.yanco.dk wordfence.com
Sep 12, 2023Leyka: Sensitive Information ExposureCVE-2023-4917 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.
Product
Leyka
Affected
up to 3.30.7
What to do
Affects up to 3.30.7. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2023Simplr Registration Form Plus+: Insecure Direct Object ReferencesCVE-2023-4213 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber-level permissions or above to change user passwords and potentially take over administrator accounts.
Product
Simplr Registration Form Plus+
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Simplr Registration Form Plus+ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 12, 2023BAN Users: Privilege escalationCVE-2023-4153 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3dev_save_ban_user_settings_callback' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify the plugin settings to access the ban and unban functionality and set the role of the unbanned user.
Product
BAN Users
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update BAN Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2023JQuery Accordion Menu Widget: Stored Cross-Site ScriptingCVE-2023-4890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
JQuery Accordion Menu Widget
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update JQuery Accordion Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
Product
MasterStudy LMS
Fixed in
3.0.18
What to do
Update MasterStudy LMS to 3.0.18 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Sep 11, 2023FTP Access: Does not have authorisation and CSRF checksCVE-2023-3510 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user.
Product
FTP Access
Affected
up to 1.0
What to do
Affects up to 1.0. Update FTP Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settingsCVE-2023-3170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
tagDiv Composer
Fixed in
4.2
What to do
Update tagDiv Composer to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST routCVE-2023-3169 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
Product
tagDiv Composer
Fixed in
4.2
What to do
Update tagDiv Composer to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2023Duplicate Post Page Menu & Custom Post Type: Unauthorized page and post duplicationCVE-2023-4792 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages.
Product
Duplicate Post Page Menu & Custom Post Type
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Duplicate Post Page Menu & Custom Post Type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2023Media Library Assistant: Local File Inclusion and Remote Code ExecutionCVE-2023-4634 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
Product
Media Library Assistant
Affected
up to 3.09
What to do
Affects up to 3.09. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Sep 4, 2023User Activity Log: Lacks proper authorisationCVE-2023-4269 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Product
User Activity Log
Fixed in
1.6.6
What to do
Update User Activity Log to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Profile Builder: Lacks authorisation and CSRF in its page creation functionCVE-2023-4059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Product
Profile Builder
Fixed in
3.9.8
What to do
Update Profile Builder to 3.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Advanced File Manager: Does not adequately authorize its usage on multisite installationsCVE-2023-3814 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
Product
Advanced File Manager
Fixed in
5.1.1
What to do
Update Advanced File Manager to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 31, 2023Waiting: One-click countdowns: Authorization bypassCVE-2023-3999 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and delete countdowns as well as manipulate other plugin settings.
Product
Waiting: One-click countdowns
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update Waiting: One-click countdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2023WooCommerce PDF Invoice Builder: SQL InjectionCVE-2023-3677 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscribers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.89
What to do
Affects up to 1.2.89. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023WP Project Manager: Privilege escalationCVE-2023-3636 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter.
Product
WP Project Manager
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023ProfileGrid: Unauthorized decryption of private informationCVE-2023-3404 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords.
Product
ProfileGrid
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023Stripe Payment Plugin for WooCommerce: Authentication bypassCVE-2023-3162 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically customers.
Product
Stripe Payment Plugin for WooCommerce
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Stripe Payment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023Quick Post Duplicator: SQL InjectionCVE-2023-2229 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Quick Post Duplicator
Affected
up to 2.0
What to do
Affects up to 2.0. Update Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2023Colibri Page Builder: SQL InjectionCVE-2023-2188 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Colibri Page Builder
Affected
up to 1.0.227
What to do
Affects up to 1.0.227. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023BadgeOS: Unauthorized modification of dataCVE-2023-2174 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the plugin's log entries.
Product
BadgeOS
Affected
up to 3.7.1.6
What to do
Affects up to 3.7.1.6. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter's first name.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2023Ninja Forms WordPress Ninja Forms Contact Form: Was affected by a HTML Injection security vulnerabilityCVE-2023-4109 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
Product
Ninja Forms WordPress Ninja Forms Contact Form
Fixed in
3.6.26
What to do
Update Ninja Forms WordPress Ninja Forms Contact Form to 3.6.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023AffiliateWP: Unauthorized modification of dataCVE-2023-4600 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.
Product
AffiliateWP
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update AffiliateWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record affiliatewp.com wordfence.com
Aug 22, 2023Donation Forms by Charitable: Privilege escalationCVE-2023-4404 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.
Product
Donation Forms by Charitable
Affected
up to 1.7.0.12
What to do
Affects up to 1.7.0.12. Update Donation Forms by Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2023Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7: Cross-site scriptingCVE-2023-40068 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
Product
Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7
What to do
Update Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 18, 2023Stripe Payment Plugin for WooCommerce: Unauthorized modification of dataCVE-2023-4040 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers to modify the order status of arbitrary WooCommerce orders.
Product
Stripe Payment Plugin for WooCommerce
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update Stripe Payment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 17, 2023Comments Like Dislike: Unauthorized modification of dataCVE-2023-3244 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: this issue is was only partially patched in version 1.2.0, as the nonce is still present to subscriber-level users.
Product
Comments Like Dislike
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Comments Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2023REST API TO MiniProgram: Does not have authorisation and CSRF checks in an AJAX actionCVE-2023-0551 · WordPress plugins & themes · reported by WPScanMedium 5.4
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments
Product
REST API TO MiniProgram
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023WP Remote Users Sync: Unauthorized access of data and addition of dataCVE-2023-4374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
Product
WP Remote Users Sync
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WP Remote Users Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2023InfiniteWP Client: Sensitive Information ExposureCVE-2023-2916 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
Product
InfiniteWP Client
Affected
up to 1.11.1
What to do
Affects up to 1.11.1. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2023Simple Author Box: Does not verify a user ID before outputting information about that userCVE-2023-3601 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
Product
Simple Author Box
Fixed in
2.52
What to do
Update Simple Author Box to 2.52 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 12, 2023Premium Packages - Sell Digital Products Securely: Privilege escalationCVE-2023-4293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
Product
Premium Packages - Sell Digital Products Securely
Affected
up to 5.7.4
What to do
Affects up to 5.7.4. Update Premium Packages - Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 11, 2023Canto: Remote File InclusionCVE-2023-3452 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
Product
Canto
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 9, 2023FULL - Customer: Information DisclosureCVE-2023-4242 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.
Product
FULL - Customer
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update FULL - Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2023Real Estate Manager: Privilege escalationCVE-2023-4239 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
Product
Real Estate Manager
Affected
up to 7.2
What to do
Affects up to 7.2. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz And Survey Master
Fixed in
8.1.11
What to do
Update Quiz And Survey Master to 8.1.11 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not have authorisationCVE-2023-3365 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.14.14
What to do
Update MultiParcels Shipping For WooCommerce to 1.14.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023Qubely: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX actionCVE-2021-24916 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
Product
Qubely
Fixed in
1.8.6
What to do
Update Qubely to 1.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 3, 2023WP Ultimate CSV Importer: Remote Code ExecutionCVE-2023-4142 · WordPress plugins & themes · reported by WordfenceHigh 8
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for site administrators, use the plugin with caution.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Remote Code ExecutionCVE-2023-4141 · WordPress plugins & themes · reported by WordfenceHigh 8
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Privilege escalationCVE-2023-4140 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Sensitive Information ExposureCVE-2023-4139 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.