Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,601 results · page 470 of 833
Dec 16, 2024Youtube Video Grid: Cross-Site Request Forgery (CSRF)CVE-2024-54408 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Video Grid: from n/a through <= 1.9.
- Product
- Youtube Video Grid
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Youtube Video Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024CK and SyntaxHighlighter: Cross-Site Request Forgery (CSRF)CVE-2024-54407 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in a328496647 CK and SyntaxHighlighter ck-and-syntaxhighlighter allows Stored XSS.This issue affects CK and SyntaxHighlighter: from n/a through <= 3.4.2.
- Product
- CK and SyntaxHighlighter
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update CK and SyntaxHighlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Comments On Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54406 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moallemi Comments On Feed comments-on-feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through <= 1.2.1.
- Product
- Comments On Feed
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Comments On Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024ECT Social Share: Cross-Site Request Forgery (CSRF)CVE-2024-54405 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Social Share ect-social-share allows Stored XSS.This issue affects ECT Social Share: from n/a through <= 1.3.
- Product
- ECT Social Share
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ECT Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024MDC Comment Toolbar: Cross-Site Request Forgery (CSRF)CVE-2024-54404 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan MDC Comment Toolbar mdc-comment-toolbar allows Stored XSS.This issue affects MDC Comment Toolbar: from n/a through <= 1.1.
- Product
- MDC Comment Toolbar
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MDC Comment Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Visual Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54403 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oktoberfive Visual Recent Posts visual-recent-posts allows Reflected XSS.This issue affects Visual Recent Posts: from n/a through <= 1.2.3.
- Product
- Visual Recent Posts
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Visual Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Arabic Webfonts: Missing AuthorizationCVE-2024-54402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arabic Webfonts: from n/a through <= 1.4.6.
- Product
- Arabic Webfonts
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Arabic Webfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Advanced Fancybox: Cross-Site Request Forgery (CSRF)CVE-2024-54401 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Advanced Fancybox advanced-fancybox allows Stored XSS.This issue affects Advanced Fancybox: from n/a through <= 1.1.1.
- Product
- Advanced Fancybox
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Advanced Fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024AppMaps: Cross-Site Request Forgery (CSRF)CVE-2024-54400 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in meloniq AppMaps appmaps allows Stored XSS.This issue affects AppMaps: from n/a through <= 1.1.
- Product
- AppMaps
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AppMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024CRUDLab Google Plus Button: Cross-Site Request Forgery (CSRF)CVE-2024-54399 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google Plus Button: from n/a through <= 1.0.2.
- Product
- CRUDLab Google Plus Button
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update CRUDLab Google Plus Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Flaming Forms: Cross-Site Request Forgery (CSRF)CVE-2024-54398 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through <= 1.0.1.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Go Animate: Cross-Site Request Forgery (CSRF)CVE-2024-54397 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in antonio.gocaj Go Animate goanimate allows Stored XSS.This issue affects Go Animate: from n/a through <= 1.0.
- Product
- Go Animate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Go Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Bet sport Free: Cross-Site Request Forgery (CSRF)CVE-2024-54396 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in elmervillanueva Bet sport Free bet-sport-free allows Cross Site Request Forgery.This issue affects Bet sport Free: from n/a through <= 1.0.0.
- Product
- Bet sport Free
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Bet sport Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Increase Sociability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54395 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preblogging Increase Sociability increase-sociability allows Reflected XSS.This issue affects Increase Sociability: from n/a through <= 1.3.0.
- Product
- Increase Sociability
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Increase Sociability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Mandrill WP: Cross-Site Request Forgery (CSRF)CVE-2024-54394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in khubbaib Mandrill WP email-form-under-post allows Stored XSS.This issue affects Mandrill WP: from n/a through <= 1.0.5.
- Product
- Mandrill WP
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Mandrill WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Fiddle: Cross-Site Request Forgery (CSRF)CVE-2024-54393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sheikh Heera WP Fiddle wp-fiddle allows Stored XSS.This issue affects WP Fiddle: from n/a through <= 1.0.
- Product
- WP Fiddle
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Fiddle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP微信机器人: Cross-Site Request Forgery (CSRF)CVE-2024-54392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in midoks WP微信机器人 wp-weixin-robot allows Stored XSS.This issue affects WP微信机器人: from n/a through <= 5.3.5.
- Product
- WP微信机器人
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update WP微信机器人 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WordPress Filter: Cross-Site Request Forgery (CSRF)CVE-2024-54391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mattwalters WordPress Filter wordpress-filter allows Stored XSS.This issue affects WordPress Filter: from n/a through <= 1.4.1.
- Product
- WordPress Filter
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WordPress Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024TagGator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected XSS.This issue affects TagGator: from n/a through <= 1.54.
- Product
- TagGator
- Affected
- up to 1.54
- What to do
- Affects up to 1.54. Update TagGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024addWeather: Cross-Site Request Forgery (CSRF)CVE-2024-54389 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Eduardo addWeather myweather allows Cross Site Request Forgery.This issue affects addWeather: from n/a through <= 2.5.1.
- Product
- addWeather
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update addWeather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Multiple Admin Emails: Cross-Site Request Forgery (CSRF)CVE-2024-54388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through <= 1.0.
- Product
- Multiple Admin Emails
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Multiple Admin Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Posts Date Ranges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54387 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaytesh Barange Posts Date Ranges posts-date-ranges allows Reflected XSS.This issue affects Posts Date Ranges: from n/a through <= 2.2.
- Product
- Posts Date Ranges
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Posts Date Ranges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart: Cross-Site Request Forgery (CSRF)CVE-2024-54386 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in pushmonkey Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart push-monkey-desktop-push-notifications allows Cross Site Request Forgery.This issue affects Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart: from n/a through <= 3.9.
- Product
- Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Radio Player: Server-Side Request Forgery (SSRF)CVE-2024-54385 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.
- Product
- Radio Player
- Affected
- up to 2.0.83
- What to do
- Affects up to 2.0.83. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2024-54384 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anh Tran Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through <= 2.8.3.
- Product
- Falcon – WordPress Optimizations & Tweaks
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Bold Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54382 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through <= 5.1.5.
- Product
- Bold Page Builder
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Cookies Enabler: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Filippo Bodei WP Cookies Enabler wp-cookies-enabler allows PHP Local File Inclusion.This issue affects WP Cookies Enabler: from n/a through <= 1.0.1.
- Product
- WP Cookies Enabler
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Cookies Enabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Minterpress: Missing AuthorizationCVE-2024-54379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Quietly Insights: Missing AuthorizationCVE-2024-54378 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through <= 1.2.2.
- Product
- Quietly Insights
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Quietly Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Woolook: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54375 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issue affects Woolook: from n/a through <= 1.7.0.
- Product
- Woolook
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Woolook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Sogrid: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54374 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.
- Product
- Sogrid
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024EduAdmin Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54373 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP Local File Inclusion.This issue affects EduAdmin Booking: from n/a through <= 5.2.0.
- Product
- EduAdmin Booking
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update EduAdmin Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Insertify: Cross-Site Request Forgery (CSRF)CVE-2024-54372 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Insertify insertify allows Code Injection.This issue affects Insertify: from n/a through <= 1.1.4.
- Product
- Insertify
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Insertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Video & Photo Gallery for Ultimate Member: Unrestricted Upload of File with Dangerous TypeCVE-2024-54370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.
- Product
- Video & Photo Gallery for Ultimate Member
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Zita Site Builder: Missing AuthorizationCVE-2024-54369 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.
- Product
- Zita Site Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Zita Site Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024GitSync: Cross-Site Request Forgery (CSRF)CVE-2024-54368 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in rubengarzajr GitSync git-sync allows Code Injection.This issue affects GitSync: from n/a through <= 1.1.0.
- Product
- GitSync
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update GitSync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024ForumWP: Deserialization of Untrusted DataCVE-2024-54367 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
- Product
- ForumWP
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update ForumWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Vimeography: Generation of Error Message Containing Sensitive InformationCVE-2024-54366 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in videogallery Vimeography vimeography allows Retrieve Embedded Sensitive Data.This issue affects Vimeography: from n/a through <= 2.4.4.
- Product
- Vimeography
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Vimeography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024KH Easy User Settings: Incorrect Privilege AssignmentCVE-2024-54365 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy User Settings: from n/a through <= 1.0.0.
- Product
- KH Easy User Settings
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update KH Easy User Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Feedpress Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54364 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spartac Feedpress Generator feedpress-generator allows Reflected XSS.This issue affects Feedpress Generator: from n/a through <= 1.2.1.
- Product
- Feedpress Generator
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Feedpress Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wp NssUser Register: Incorrect Privilege AssignmentCVE-2024-54363 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through <= 1.0.0.
- Product
- Wp NssUser Register
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Wp NssUser Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Instant Appointment: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54361 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allows SQL Injection.This issue affects Instant Appointment: from n/a through <= 1.2.
- Product
- Instant Appointment
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Gutensee: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54360 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in premila Gutensee gutensee allows DOM-Based XSS.This issue affects Gutensee: from n/a through <= 1.0.6.
- Product
- Gutensee
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Gutensee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Banner System: Missing AuthorizationCVE-2024-54359 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Saul Morales Pacheco Banner System banner-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Banner System: from n/a through <= 1.0.0.
- Product
- Banner System
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Banner System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 20243D Avatar User Profile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through <= 1.0.0.
- Product
- 3D Avatar User Profile
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update 3D Avatar User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Cross-Site Request Forgery (CSRF)CVE-2024-54356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Mailster: Cross-Site Request Forgery (CSRF)CVE-2024-54355 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in brandtoss WP Mailster wp-mailster allows Cross Site Request Forgery.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
- Product
- WP Mailster
- Affected
- up to 1.8.17.0
- What to do
- Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Termin-Kalender: Missing AuthorizationCVE-2024-54354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in beat.k Termin-Kalender termin-kalender allows Stored XSS.This issue affects Termin-Kalender: from n/a through <= 0.99.47.
- Product
- Termin-Kalender
- Affected
- up to 0.99.47
- What to do
- Affects up to 0.99.47. Update Termin-Kalender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Hack-Info: Cross-Site Request Forgery (CSRF)CVE-2024-54353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpgear Hack-Info hack-info allows Stored XSS.This issue affects Hack-Info: from n/a through <= 3.17.
- Product
- Hack-Info
- Affected
- up to 3.17
- What to do
- Affects up to 3.17. Update Hack-Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Sogrid: Cross-Site Request Forgery (CSRF)CVE-2024-54352 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Sabri Sogrid sogrid allows Privilege Escalation.This issue affects Sogrid: from n/a through <= 1.5.2.
- Product
- Sogrid
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.