Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

413new WordPress flaws this week

399,200entries in the database

41,601 results · page 484 of 833

Dec 6, 2024Slider and Carousel slider by Depicter: Stored Cross-Site ScriptingCVE-2024-4633 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider and Carousel slider by Depicter
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Slider and Carousel slider by Depicter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Swift Performance Lite: Local PHP File InclusionCVE-2024-10516 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Swift Performance Lite
Affected
up to 2.3.7.1
What to do
Affects up to 2.3.7.1. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11730 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor/receptionist-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11729 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11728 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Verowa Connect: SQL InjectionCVE-2024-11460 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Verowa Connect plugin for WordPress is vulnerable to SQL Injection via the 'search_string' parameter in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Verowa Connect
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Soledad: Local File InclusionCVE-2024-11289 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.5.9 via several functions like penci_archive_more_post_ajax_func, penci_more_post_ajax_func, and penci_more_featured_post_ajax_func. This makes it possible for unauthenticated attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. The exploitability of this is limited to Windows.
Product
Soledad
Affected
up to 8.5.9
What to do
Affects up to 8.5.9. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Dec 6, 2024The Pojo Forms: Arbitrary shortcode executionCVE-2024-10909 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. This was partially fixed in version 1.4.8.
Product
The Pojo Forms
Affected
up to 1.4.7
Fixed in
1.4.8
What to do
Update The Pojo Forms to 1.4.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Arbitrary shortcode executionCVE-2024-10681 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.0.51. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Affected
up to 4.0.51
What to do
Affects up to 4.0.51. Update The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2024-9872 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and update settings.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Event Tickets with Ticket Scanner: Stored Cross-Site ScriptingCVE-2024-9866 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Event Tickets with Ticket Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping and missing authorization on the functionality to manage tickets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This missing authorization aspect of this was patched in 2.4.1, while the Cross-Site Scripting was fully patched in 2.4.4.
Product
Event Tickets with Ticket Scanner
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Ultimate Coming Soon & Maintenance: Unauthorized modification of dataCVE-2024-9706 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsm_activate_lite_template_lite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change the template used for the coming soon / maintenance page.
Product
Ultimate Coming Soon & Maintenance
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Ultimate Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Ultimate Coming Soon & Maintenance: Unauthorized modification of dataCVE-2024-9705 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsm_update_template_name_lite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the name of the plugin's templates.
Product
Ultimate Coming Soon & Maintenance
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Ultimate Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024SV100 Companion: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12155 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settings_import() function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2024-54229 may be a duplicate of this issue.
Product
SV100 Companion
Affected
up to 2.0.02
What to do
Affects up to 2.0.02. Update SV100 Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Gold Addons for Elementor: Unauthorized modification of dataCVE-2024-12110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gold Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate() and deactivate() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate and deactivate licenses.
Product
Gold Addons for Elementor
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Gold Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024WP Media Optimizer (.webp): Reflected Cross-Site ScriptingCVE-2024-12060 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Media Optimizer (.webp) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpmowebp-css-resources’ and 'wpmowebp-js-resources' parameters in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Media Optimizer (.webp)
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WP Media Optimizer (.webp) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024Friends: Unauthorized accessCVE-2024-12028 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to send arbitrary friend requests on behalf of another website, accept the friend request for the targeted website, and then communicate with the site as an accepted friend.
Product
Friends
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Friends to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024Message Filter for Contact Form 7: Unauthorized modification of dataCVE-2024-12027 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter() and deleteFilter() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update and delete filters.
Product
Message Filter for Contact Form 7
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024WP System: Cross-Site Request ForgeryCVE-2024-12003 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generate_wp_system_page_content() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP System
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Folder Gallery: Stored Cross-Site ScriptingCVE-2024-11823 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Folder Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'foldergallery' shortcode in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Folder Gallery
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Folder Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024Next-Cart Store to WooCommerce Migration: Reflected Cross-Site ScriptingCVE-2024-11687 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Next-Cart Store to WooCommerce Migration
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Next-Cart Store to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024ONLYOFFICE Docs: Stored Cross-Site ScriptingCVE-2024-11450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ONLYOFFICE Docs
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update ONLYOFFICE Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024CLUEVO LMS, E-Learning Platform: Cross-Site Request ForgeryCVE-2024-11444 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due to missing or incorrect nonce validation on the cluevo_render_module_ui() function. This makes it possible for unauthenticated attackers to delete modules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CLUEVO LMS, E-Learning Platform
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update CLUEVO LMS, E-Learning Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Splash Sync: Reflected Cross-Site ScriptingCVE-2024-11368 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Splash Sync plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Splash Sync
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Splash Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024TwentyTwenty: Stored Cross-Site ScriptingCVE-2024-11352 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TwentyTwenty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twentytwenty' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TwentyTwenty
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update TwentyTwenty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Smart PopUp Blaster: Stored Cross-Site ScriptingCVE-2024-11339 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart PopUp Blaster
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart PopUp Blaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Clickbank WordPress Plugin (Storefront): Cross-Site Request ForgeryCVE-2024-11336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Clickbank WordPress Plugin (Storefront) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the cs_menu page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Clickbank WordPress Plugin (Storefront)
Affected
up to 1.7
What to do
Affects up to 1.7. Update Clickbank WordPress Plugin (Storefront) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024AI Quiz | Quiz Maker: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11323 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ai_quiz_update_style() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
AI Quiz | Quiz Maker
Affected
up to 1.1
What to do
Affects up to 1.1. Update AI Quiz | Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024WP Private Content Plus: Sensitive Information ExposureCVE-2024-11292 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
WP Private Content Plus
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update WP Private Content Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024PDF Builder for WooCommerce. Create invoices,packing slips and more: Reflected Cross-Site ScriptingCVE-2024-11276 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.2.136 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Builder for WooCommerce. Create invoices,packing slips and more
Affected
up to 1.2.136
What to do
Affects up to 1.2.136. Update PDF Builder for WooCommerce. Create invoices,packing slips and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024ForumWP – Forum & Discussion Board: Reflected Cross-Site ScriptingCVE-2024-11204 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ForumWP – Forum & Discussion Board
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update ForumWP – Forum & Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024ForumWP – Forum & Discussion Board: Reflected Cross-Site ScriptingCVE-2024-10879 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ForumWP – Forum & Discussion Board
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update ForumWP – Forum & Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024NewsMash: Stored Cross-Site ScriptingCVE-2024-10849 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NewsMash theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-56208 is a duplicate of this issue.
Product
NewsMash
Affected
up to 1.0.71
What to do
Affects up to 1.0.71. Update NewsMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Dec 6, 2024PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Information ExposureCVE-2024-10692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024XLTab – Accordions and Tabs for Elementor Page Builder: Information ExposureCVE-2024-10689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 via the 'XLTAB_INSERT_TPL' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
XLTab – Accordions and Tabs for Elementor Page Builder
Affected
up to 1.4
What to do
Affects up to 1.4. Update XLTab – Accordions and Tabs for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Cookielay: Stored Cross-Site ScriptingCVE-2024-10320 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cookielay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookielay shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cookielay
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Cookielay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 6, 2024Login With OTP: Authentication bypassCVE-2024-11178 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the 6-digit numeric OTP that makes it possible to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
Login With OTP
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Login With OTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024WP Hide & Security Enhancer: Arbitrary file contents deletionCVE-2024-11585 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file path validation in the file-process.php in all versions up to, and including, 2.5.1. This makes it possible for unauthenticated attackers to delete the contents of arbitrary files on the server, which can break the site or lead to data loss.
Product
WP Hide & Security Enhancer
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Hide & Security Enhancer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-11201 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_send shortcode in all versions up to, and including, 2.7.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.7.5.2
What to do
Affects up to 2.7.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Pubnews: Unauthorized arbitrary plugin installationCVE-2024-10578 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins that can be leveraged to exploit other vulnerabilities.
Product
Pubnews
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Pubnews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Dec 6, 2024Sticky Social Icons: Does not sanitise and escape some of its settingsCVE-2024-10551 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sticky Social Icons
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 6, 20243DPrint Lite: Does not have CSRF check in placeCVE-2024-10480 · WordPress plugins & themes · reported by WPScanMedium 4.3
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
3DPrint Lite
Fixed in
2.1
What to do
Update 3DPrint Lite to 2.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 6, 2024Broadcast: Reflected Cross-Site ScriptingCVE-2024-11379 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Broadcast plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'do_check' parameter in all versions up to, and including, 51.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations.
Product
Broadcast
Affected
up to 51.01
What to do
Affects up to 51.01. Update Broadcast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2024Video Gallery – Best WordPress YouTube Gallery: Stored Cross-Site ScriptingCVE-2024-9769 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Video Gallery – Best WordPress YouTube Gallery
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Video Gallery – Best WordPress YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Dec 5, 2024Flixita: Reflected Cross-Site ScriptingCVE-2024-10836 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Flixita theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.82 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Flixita
Affected
up to 1.0.82
What to do
Affects up to 1.0.82. Update Flixita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Dec 5, 2024Video Gallery – Best WordPress YouTube Gallery: Time-based SQL InjectionCVE-2024-10247 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Video Gallery – Best WordPress YouTube Gallery
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Video Gallery – Best WordPress YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 5, 2024WIP WooCarousel Lite: Stored Cross-Site ScriptingCVE-2024-11779 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WIP WooCarousel Lite
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WIP WooCarousel Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2024Blocksy: Stored Cross-Site ScriptingCVE-2024-11420 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2.0.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blocksy
Affected
up to 2.0.77
What to do
Affects up to 2.0.77. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Dec 5, 2024Simple Redirection: Cross-Site Request ForgeryCVE-2024-11341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Simple Redirection
Affected
up to 1.5
What to do
Affects up to 1.5. Update Simple Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2024Accounting for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11324 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Accounting for WooCommerce
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Accounting for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.