Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

271 results · page 5 of 6

Sep 13, 2024Lucas String Replace: Reflected Cross-Site ScriptingCVE-2024-8734 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Lucas String Replace
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Lucas String Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Unauthorized arbitrary file deletionCVE-2024-7856 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file' parameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files which can make remote code execution possible when wp-config.php is deleted.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.7.0.1
What to do
Affects up to 5.7.0.1. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid: Stored Cross-Site ScriptingCVE-2024-8046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 18, 2024Team Showcase: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43321 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS.This issue affects Team Showcase: from n/a through 1.22.23.
Product
Team Showcase
Affected
up to 1.22.23
What to do
Affects up to 1.22.23. Update Team Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024StreamCast: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43148 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins StreamCast allows Stored XSS.This issue affects StreamCast: from n/a through 2.2.3.
Product
StreamCast
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update StreamCast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2024Seriously Simple Podcasting: Does not sanitise and escape some of its settingsCVE-2024-3751 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Seriously Simple Podcasting
Fixed in
3.3.0
What to do
Update Seriously Simple Podcasting to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024PowerPress Podcasting plugin by Blubrry: Reflected Cross-Site ScriptingCVE-2024-6588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PowerPress Podcasting plugin by Blubrry
Affected
up to 11.9.10
What to do
Affects up to 11.9.10. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2024-5664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.5
What to do
Affects up to 5.5. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Podlove Podcast Publisher: Missing AuthorizationCVE-2024-32143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0.
Product
Podlove Podcast Publisher
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 21, 2024YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for: Unauthorized modification of dataCVE-2024-3268 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the emd_form_builder_lite_submit_form function in all versions up to, and including, 3.3.6. This makes it possible for unauthenticated attackers to create arbitrary posts or pages.
Product
YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Podlove Podcast Publisher: Missing AuthorizationCVE-2024-32712 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.
Product
Podlove Podcast Publisher
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024AA Cash Calculator: Reflected Cross-Site ScriptingCVE-2024-0848 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AA Cash Calculator
Affected
up to 1.0
What to do
Affects up to 1.0. Update AA Cash Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2024Podlove Podcast Publisher: Server-Side Request Forgery (SSRF)CVE-2024-32812 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11.
Product
Podlove Podcast Publisher
Affected
up to 4.0.11
What to do
Affects up to 4.0.11. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32530 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5.
Product
Simple Testimonials Showcase
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Podlove Podcast Publisher: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32139 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.12.
Product
Podlove Podcast Publisher
Affected
up to 4.0.12
What to do
Affects up to 4.0.12. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-31343 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30530 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 5.1
What to do
Affects up to 5.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-30487 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 5.1
What to do
Affects up to 5.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024wp-forecast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forecast: from n/a through 9.2.
Product
wp-forecast
Affected
up to 9.2
What to do
Affects up to 9.2. Update wp-forecast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25599 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting.This issue affects Seriously Simple Podcasting: from n/a through <= 3.0.2.
Product
Seriously Simple Podcasting
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Podlove Podcast Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29915 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Reflected XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.0.9.
Product
Podlove Podcast Publisher
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid: PHP Object InjectionCVE-2024-1951 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization via shortcode of untrusted input. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds: Unauthorized access of dataCVE-2024-1690 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to export a list of registered users and their emails.
Product
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2024Seriously Simple Podcasting: Discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted requestCVE-2023-6444 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
Product
Seriously Simple Podcasting
Fixed in
3.0.0
What to do
Update Seriously Simple Podcasting to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 29, 2024Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: Cross-Site Request Forgery (CSRF)CVE-2023-51530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation.This issue affects Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: from n/a through 3.5.1.
Product
Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 7, 2024Podlove Podcast Publisher: Unauthorized modification of dataCVE-2024-1110 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.
Product
Podlove Podcast Publisher
Affected
up to 4.0.11
What to do
Affects up to 4.0.11. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 7, 2024Podlove Podcast Publisher: Unauthorized access of dataCVE-2024-1109 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.
Product
Podlove Podcast Publisher
Affected
up to 4.0.11
What to do
Affects up to 4.0.11. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 15, 2023DoFollow Case by Case: Cross-Site Request Forgery (CSRF)CVE-2023-49197 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case.This issue affects DoFollow Case by Case: from n/a through 3.4.2.
Product
DoFollow Case by Case
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Simple Testimonials Showcase: Cross-Site Request Forgery (CSRF)CVE-2023-48283 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Testimonials Showcase allows Cross Site Request Forgery.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5.
Product
Simple Testimonials Showcase
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023PowerPress Podcasting plugin by Blubrry: Server-Side Request Forgery (SSRF)CVE-2023-41239 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6.
Product
PowerPress Podcasting plugin by Blubrry
Affected
up to 11.0.6
What to do
Affects up to 11.0.6. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions.CVE-2023-28420 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions.
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.CVE-2023-34031 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 30, 2023Buzzsprout Podcasting: Stored Cross-Site ScriptingCVE-2023-5335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Buzzsprout Podcasting
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Buzzsprout Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Podcast Subscribe Buttons: Stored Cross-Site ScriptingCVE-2023-5308 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Podcast Subscribe Buttons
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Podcast Subscribe Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2023Team Showcase: Stored Cross-Site ScriptingCVE-2023-5639 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Showcase
Affected
up to 2.1
What to do
Affects up to 2.1. Update Team Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023PowerPress Podcasting plugin by Blubrry: Does not sanitize and escape the media url field in postsCVE-2023-4820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.0.12
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.0.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.CVE-2023-40558 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.
Fixed in
3.3.6
What to do
Update the plugin to 3.3.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.CVE-2023-25472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.
Fixed in
3.8.4
What to do
Update the plugin to 3.8.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2023GS Books Showcase: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GS Books Showcase
Fixed in
1.3.1
What to do
Update GS Books Showcase to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Seriously Simple Podcasting
Fixed in
2.19.1
What to do
Update Seriously Simple Podcasting to 2.19.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change.CVE-2022-40132 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change.
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.CVE-2022-35725 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.
Affected
up to 7.5
What to do
Affects up to 7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 2, 2022Import WP: Does not validate the imported file in some casesCVE-2022-1273 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
Product
Import WP
Fixed in
2.4.6
What to do
Update Import WP to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Product
Podcast Importer SecondLine
Fixed in
1.3.8
What to do
Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF check in the lswss_save_attachment_data AJAX actionCVE-2021-24913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
Product
Logo Showcase with Slick Slider
Fixed in
2.0.1
What to do
Update Logo Showcase with Slick Slider to 2.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX actionCVE-2021-24730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.5
What to do
Update Logo Showcase with Slick Slider to 1.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Logo Showcase with Slick Slider: Does not sanitise the Grid SettingsCVE-2021-24729 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.4
What to do
Update Logo Showcase with Slick Slider to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Logo Slider and Showcase: Allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability checkCVE-2021-24742 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.
Product
Logo Slider and Showcase
Fixed in
1.3.37
What to do
Update Logo Slider and Showcase to 1.3.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Fixed in
2.4.2
What to do
Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Podcast Subscribe Buttons: Allows users with any role capable of editing or adding posts to perform stored XSSCVE-2021-24743 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.
Product
Podcast Subscribe Buttons
Fixed in
1.4.2
What to do
Update Podcast Subscribe Buttons to 1.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.