Updated 16 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

3,905 results · page 54 of 79

Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5283 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5281 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in some placesCVE-2024-5280 · WordPress plugins & themes · reported by WPScanMedium 4.7
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024OpenPGP Form Encryption for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3919 · WordPress plugins & themes · reported by WPScanMedium 4.6
The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenPGP Form Encryption for
Fixed in
1.5.1
What to do
Update OpenPGP Form Encryption for to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Stored Cross-Site ScriptingCVE-2024-5902 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in feedback form responses that will execute whenever a high-privileged user tries to view them.
Product
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2024Form Vibes: SQL InjectionCVE-2024-5325 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Form Vibes
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update Form Vibes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 10, 2024Duplicator: Information exposureCVE-2024-6210 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Product
Duplicator
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024FileBird Document Library: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6.
Product
FileBird Document Library
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update FileBird Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Table & Contact Form 7 Database – Tablesome: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024TrustedLogin Vendor: Insertion of Sensitive Information into Log FileCVE-2024-37270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
Product
TrustedLogin Vendor
Fixed in
1.1.1
What to do
Update TrustedLogin Vendor to 1.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024affiliate-toolkit: Insertion of Sensitive Information into Log FileCVE-2024-37205 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4.
Product
affiliate-toolkit
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Newspack Blocks: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37115 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0.8.
Product
Newspack Blocks
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37113 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Gravity Forms: Multiple Form Instances: Full Path DisclosureCVE-2024-6550 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Gravity Forms: Multiple Form Instances
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Gravity Forms: Multiple Form Instances to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Ninja Forms: Improper Control of Generation of Code ('Code Injection')CVE-2024-37934 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.
Product
Ninja Forms
Affected
up to 3.8.4
What to do
Affects up to 3.8.4. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress CVE-2024-6069 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server
Affected
up to 3.8.3.4
What to do
Affects up to 3.8.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Social Sharing Plugin – Kiwi: Information ExposureCVE-2024-3228 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.
Product
Social Sharing Plugin – Kiwi
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Social Sharing Plugin – Kiwi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6316 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-37555 is a duplicate of this issue.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Gutenberg Forms: Arbitrary file uploadsCVE-2024-6313 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Gutenberg Forms
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Gutenberg Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Bit Form: Arbitrary file uploadsCVE-2024-6123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Bit Form
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Unrestricted Upload of File with Dangerous TypeCVE-2024-37555 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 2, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-5260 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘read_more_text’ parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Void Contact Form 7 Widget For Elementor Page Builder: Stored Cross-Site ScriptingCVE-2024-5419 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Void Contact Form 7 Widget For Elementor Page Builder
Affected
up to 2.4
What to do
Affects up to 2.4. Update Void Contact Form 7 Widget For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2024Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-6130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Form Maker by 10Web
Fixed in
1.15.26
What to do
Update Form Maker by 10Web to 1.15.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 29, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2024-6265 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 29, 2024Advanced File Manager: Sensitive Information ExposureCVE-2024-5598 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Product
Advanced File Manager
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2024SEO SIMPLE PACK: Information ExposureCVE-2024-2795 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SEO SIMPLE PACK plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.1 via META description. This makes it possible for unauthenticated attackers to extract limited information about password protected posts.
Product
SEO SIMPLE PACK
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update SEO SIMPLE PACK to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 27, 2024Contact Form 7: Has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosingCVE-2024-4704 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing.
Product
Contact Form 7
Fixed in
5.9.5
What to do
Update Contact Form 7 to 5.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP 2FA: Insertion of Sensitive Information into Log FileCVE-2022-44587 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.
Product
WP 2FA
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update WP 2FA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WordPress Form Builder Plugin – Gutenberg Forms: Missing AuthorizationCVE-2022-45803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Builder Plugin – Gutenberg Forms: from n/a through 2.2.8.3.
Product
WordPress Form Builder Plugin – Gutenberg Forms
Affected
up to 2.2.8.3
What to do
Affects up to 2.2.8.3. Update WordPress Form Builder Plugin – Gutenberg Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Event Management Tickets Booking: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-5059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0.
Product
Event Management Tickets Booking
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Event Management Tickets Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024phpinfo() WP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35776 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0.
Product
phpinfo() WP
Affected
up to 5.0
What to do
Affects up to 5.0. Update phpinfo() WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 20, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-5036 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38393 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Product
Ninja Forms
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38386 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Product
Ninja Forms
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WP Go Maps (formerly WP Google Maps): Stored Cross-Site ScriptingCVE-2024-5994 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an administrator, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 9.0.39 adds a caution to make administrators aware of the possibility for abuse if permissions are granted to lower-level users.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 9.0.38
What to do
Affects up to 9.0.38. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024Everest Forms: Missing AuthorizationCVE-2023-51377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3.
Product
Everest Forms
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Easy WP SMTP by SendLayer – WordPress SMTP and Email Log: Information exposureCVE-2024-3073 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment.
Product
Easy WP SMTP by SendLayer – WordPress SMTP and Email Log
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Easy WP SMTP by SendLayer – WordPress SMTP and Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024WooCommerce is an open-source e-commerce platform built on WordPress.CVE-2024-37297 · WordPress plugins & themes · reported by GitHubMedium 5.4
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record developer.woocommerce.com github.com
Jun 12, 2024weForms: Missing AuthorizationCVE-2023-51524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
Product
weForms
Affected
up to 1.6.18
What to do
Affects up to 1.6.18. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Piotnet Forms: Missing AuthorizationCVE-2023-51413 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.29.
Product
Piotnet Forms
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024ARForms - Premium WordPress Form Builder: Does not properly escape user-controlled inputCVE-2024-0427 · WordPress plugins & themes · reported by WPScanMedium 6.3
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions.
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.4.1
What to do
Update ARForms - Premium WordPress Form Builder to 6.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 11, 2024WP Fundraising Donation and Crowdfunding Platform: Missing AuthorizationCVE-2024-34758 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4.
Product
WP Fundraising Donation and Crowdfunding Platform
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update WP Fundraising Donation and Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Happyforms: Missing AuthorizationCVE-2024-23521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10.
Product
Happyforms
Affected
up to 1.25.10
What to do
Affects up to 1.25.10. Update Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Sensitive Information ExposureCVE-2024-4266 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
Product
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Advanced Contact form 7 DB: Unauthorized access of dataCVE-2024-4319 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms.
Product
Advanced Contact form 7 DB
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Advanced Contact form 7 DB: Sensitive Information ExposureCVE-2024-3723 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Product
Advanced Contact form 7 DB
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.