Updated 18 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

41,601 results · page 457 of 833

Jan 7, 2025워드프레스 결제 심플페이: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56281 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows PHP Local File Inclusion.This issue affects 워드프레스 결제 심플페이: from n/a through <= 5.2.0.
Product
워드프레스 결제 심플페이
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update 워드프레스 결제 심플페이 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WPGuppy: Incorrect Privilege AssignmentCVE-2024-56280 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/a through <= 1.1.0.
Product
WPGuppy
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Compact WP Audio Player: Server-Side Request Forgery (SSRF)CVE-2024-56279 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through <= 1.9.14.
Product
Compact WP Audio Player
Affected
up to 1.9.14
What to do
Affects up to 1.9.14. Update Compact WP Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP Ultimate Exporter: Improper Control of Generation of Code ('Code Injection')CVE-2024-56278 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.1.
Product
WP Ultimate Exporter
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Contact Form by WPForms: Missing AuthorizationCVE-2024-56276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
Product
Contact Form by WPForms
Affected
up to 1.9.2.2
What to do
Affects up to 1.9.2.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Envato Elements: Server-Side Request Forgery (SSRF)CVE-2024-56275 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a through 2.0.14.
Product
Envato Elements
Affected
up to 2.0.14
What to do
Affects up to 2.0.14. Update Envato Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Astra Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56274 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.15.
Product
Astra Widgets
Affected
up to 1.2.15
What to do
Affects up to 1.2.15. Update Astra Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WPvivid Backup and Migration: Missing AuthorizationCVE-2024-56273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPvivid Backup and Migration: from n/a through <= 0.9.106.
Product
WPvivid Backup and Migration
Affected
up to 0.9.106
What to do
Affects up to 0.9.106. Update WPvivid Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56271 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
Product
WP SecureSubmit
Affected
up to 1.5.20
What to do
Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025ClickWhale: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51715 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.
Product
ClickWhale
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025NAVER Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eutrue NAVER Analytics naver-analytics allows Stored XSS.This issue affects NAVER Analytics: from n/a through <= 0.9.
Product
NAVER Analytics
Affected
up to 0.9
What to do
Affects up to 0.9. Update NAVER Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025CubeWP Forms: Missing AuthorizationCVE-2024-51651 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.10.
Product
CubeWP Forms
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49649 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
Product
Build App Online
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Accessibility by AllAccessible: Incorrect Privilege AssignmentCVE-2024-49644 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Accessibility by AllAccessible: from n/a through <= 1.3.4.
Product
Accessibility by AllAccessible
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Accessibility by AllAccessible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025DirectoryPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows Reflected XSS.This issue affects DirectoryPress: from n/a through <= 3.6.19.
Product
DirectoryPress
Affected
up to 3.6.19
What to do
Affects up to 3.6.19. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Bus Ticket Booking with Seat Reservation: Cross-Site Request Forgery (CSRF)CVE-2024-49294 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Cross Site Request Forgery.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.4.3.
Product
Bus Ticket Booking with Seat Reservation
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025SMSA Shipping: Path Traversal: '.../...//'CVE-2024-49249 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.
Product
SMSA Shipping
Affected
up to 2.3
What to do
Affects up to 2.3. Update SMSA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WPGuppy: Deserialization of Untrusted DataCVE-2024-49222 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.
Product
WPGuppy
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025JobBoard Job listing: Unrestricted Upload of File with Dangerous TypeCVE-2024-43243 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through <= 1.2.6.
Product
JobBoard Job listing
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update JobBoard Job listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WordPress File Upload: Unauthorized access of dataCVE-2024-12719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed.
Product
WordPress File Upload
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Service Box: Stored Cross-Site ScriptingCVE-2024-12699 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Service Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Service Box
Affected
up to 1.9
What to do
Affects up to 1.9. Update Service Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025MIPL WC Multisite Sync: Directory TraversalCVE-2024-12152 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
MIPL WC Multisite Sync
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update MIPL WC Multisite Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Coupon: Stored Cross-Site ScriptingCVE-2024-12516 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Coupon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Coupon Code' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Coupon
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Croma Music: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12202 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'ironMusic_ajax' function in all versions up to, and including, 3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Croma Music
Affected
up to 3.6
What to do
Affects up to 3.6. Update Croma Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record croma.irontemplates.com wordfence.com
Jan 7, 2025The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versCVE-2024-12077 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Export Import Menus: Unauthorized access of dataCVE-2024-10866 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() function in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to export menu data and settings.
Product
Export Import Menus
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Export Import Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.6.7
What to do
Affects up to 2.0.6.7. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record master-addons.com plugins.trac.wordpress.org
Jan 7, 2025Estatik Mortgage Calculator: Reflected Cross-Site ScriptingCVE-2024-9354 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Estatik Mortgage Calculator
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Estatik Mortgage Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Aurum - WordPress & WooCommerce Shopping: Unauthorized modification of dataCVE-2024-12781 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content.
Product
Aurum - WordPress & WooCommerce Shopping
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Aurum - WordPress & WooCommerce Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.laborator.co wordfence.com
Jan 7, 2025Sina Extension for Elementor: Stored Cross-Site ScriptingCVE-2024-12624 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sina Extension for Elementor
Affected
up to 3.5.91
What to do
Affects up to 3.5.91. Update Sina Extension for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025WP jQuery DataTable: Stored Cross-Site ScriptingCVE-2024-12499 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP jQuery DataTable
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Bootstrap Blocks for WP Editor v2: Stored Cross-Site ScriptingCVE-2024-12495 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bootstrap Blocks for WP Editor v2
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Bootstrap Blocks for WP Editor v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Marketplace Items: Stored Cross-Site ScriptingCVE-2024-12437 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Marketplace Items
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Marketplace Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025Solar Wizard Lite: Stored Cross-Site ScriptingCVE-2024-11764 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Solar Wizard Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'solar_wizard' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Solar Wizard Lite
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Solar Wizard Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025SMS Alert Order Notifications – WooCommerce: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11725 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.7.6
What to do
Affects up to 3.7.6. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Passster – Password Protect Pages and Content: Sensitive Information ExposureCVE-2024-11282 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Passster – Password Protect Pages and Content
Affected
up to 4.2.10
What to do
Affects up to 4.2.10. Update Passster – Password Protect Pages and Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Social Rocket – Social Sharing: Stored Cross-Site ScriptingCVE-2024-9702 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Rocket – Social Sharing
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Social Rocket – Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Social Rocket – Social Sharing: Unauthorized modification of dataCVE-2024-9697 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Social Rocket – Social Sharing
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Social Rocket – Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Category Posts Widget: Does not sanitise and escape some of its settingsCVE-2024-9638 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Category Posts Widget
Fixed in
4.9.18
What to do
Update Category Posts Widget to 4.9.18 or newer.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025WordPress Auction: Does not sanitise and escape some of its settingsCVE-2024-8857 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks.
Product
WordPress Auction
Affected
up to 3.7
What to do
Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025WordPress Auction: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8855 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
Product
WordPress Auction
Affected
up to 3.7
What to do
Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025Error Log Viewer By WP Guru: Arbitrary File ReadCVE-2024-12849 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Error Log Viewer By WP Guru
Affected
up to 1.0.1.3
What to do
Affects up to 1.0.1.3. Update Error Log Viewer By WP Guru to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025JoomSport – for Sports: Team & League, Football, Hockey & more: Reflected Cross-Site ScriptingCVE-2024-12633 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
JoomSport – for Sports: Team & League, Football, Hockey & more
Affected
up to 5.6.17
What to do
Affects up to 5.6.17. Update JoomSport – for Sports: Team & League, Football, Hockey & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Host PHP Info: Unauthorized access of dataCVE-2024-12535 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Product
Host PHP Info
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Host PHP Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator: Arbitrary files uploadsCVE-2024-12471 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.
Product
Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025Chatroll Live Chat: Stored Cross-Site ScriptingCVE-2024-12464 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Chatroll Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chatroll' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chatroll Live Chat
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Chatroll Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Candifly: Stored Cross-Site ScriptingCVE-2024-12440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Candifly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'candifly' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Candifly
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Candifly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025Marketplace Items: Stored Cross-Site ScriptingCVE-2024-12439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Marketplace Items
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Marketplace Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket: Reflected Cross-Site ScriptingCVE-2024-12438 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date’ and 'end_date' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket
Affected
up to 4.75
What to do
Affects up to 4.75. Update WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Binary MLM Woocommerce: Reflected Cross-Site ScriptingCVE-2024-12384 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Binary MLM Woocommerce
Affected
up to 2.0
What to do
Affects up to 2.0. Update Binary MLM Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.