Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

3,808 results · page 58 of 77

Jun 14, 2024Canto: Remote File InclusionCVE-2024-4936 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit.
Product
Canto
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2024ProfileGrid: Missing AuthorizationCVE-2023-52117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through 5.6.6.
Product
ProfileGrid
Affected
up to 5.6.6
What to do
Affects up to 5.6.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024BuddyPress Cover: Unrestricted Upload of File with Dangerous TypeCVE-2024-35746 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: from n/a through 2.1.4.2.
Product
BuddyPress Cover
Affected
up to 2.1.4.2
What to do
Affects up to 2.1.4.2. Update BuddyPress Cover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024SC filechecker: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35743 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Siteclean SC filechecker allows Path Traversal, File Manipulation.This issue affects SC filechecker: from n/a through 0.6.
Product
SC filechecker
Affected
up to 0.6
What to do
Affects up to 0.6. Update SC filechecker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024MelaPress Login Security: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-35650 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security melapress-login-security.This issue affects MelaPress Login Security: from n/a through <= 1.3.0.
Product
MelaPress Login Security
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024USPS Shipping for WooCommerce – Live Rates: Insertion of Sensitive Information into Log FileCVE-2024-32811 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4.
Product
USPS Shipping for WooCommerce – Live Rates
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update USPS Shipping for WooCommerce – Live Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024FileOrganizer – Manage WordPress and Website Files: Sensitive Information ExposureCVE-2024-5599 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Product
FileOrganizer – Manage WordPress and Website Files
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024ARForms - Premium WordPress Form Builder: Allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploadedCVE-2024-4620 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.6
What to do
Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2024Qi Addons For Elementor: Local File InclusionCVE-2024-4887 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Please note that this requires an attacker to create a non-existent directory or target an instance where file_exists won't return false with a non-existent directory in the path, in order to successfully exploit.
Product
Qi Addons For Elementor
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024WP-Recall – Registration, Profile, Commerce & More: Unauthorized loss of dataCVE-2024-1175 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_payment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete arbitrary payments.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.6
What to do
Affects up to 16.26.6. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 5, 2024Cowidgets – Elementor Addons: Local File InclusionCVE-2024-5179 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'item_style' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE-2024-37419 is likely a duplicate of this issue.
Product
Cowidgets – Elementor Addons
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 5, 2024ProfileGrid – User Profiles, Groups and Communities: Unauthorized modification of dataCVE-2024-5453 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.8.6
What to do
Affects up to 5.8.6. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Easy Forms for Mailchimp: Insertion of Sensitive Information into Log FileCVE-2024-25095 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Easy Digital Downloads – Recent Purchases: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-35629 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads – Recent Purchases: from n/a through 1.0.2.
Product
Easy Digital Downloads – Recent Purchases
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Digital Downloads – Recent Purchases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Unrestricted Upload of File with Dangerous TypeCVE-2023-33930 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Code Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.66.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.66
What to do
Affects up to 1.5.66. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Social Link Pages: link-in-bio landing pages for your social media profiles: Unauthorized accessCVE-2024-3555 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the import_link_pages() function in all versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to inject arbitrary pages and malicious web scripts.
Product
Social Link Pages: link-in-bio landing pages for your social media profiles
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Social Link Pages: link-in-bio landing pages for your social media profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 3, 2024Debug Log – Manger Tool: Insertion of Sensitive Information into Log FileCVE-2024-34798 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log – Manger Tool.This issue affects Debug Log – Manger Tool: from n/a through 1.4.5.
Product
Debug Log – Manger Tool
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Debug Log – Manger Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024Elements For Elementor: Local File InclusionCVE-2024-5348 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'beforeafter_layout' attribute of the beforeafter widget, the 'eventsgrid_layout' attribute of the eventsgrid and list widgets, the 'marquee_layout' attribute of the marquee widget, the 'postgrid_layout' attribute of the postgrid widget, the 'woocart_layout' attribute of the woocart widget, and the 'woogrid_layout' attribute of the woogrid widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Elements For Elementor
Affected
up to 2.1
What to do
Affects up to 2.1. Update Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2024Uploadcare File Uploader and Adaptive Delivery (beta): Cross-Site Request Forgery (CSRF)CVE-2024-35636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery (beta): from n/a through 3.0.11.
Product
Uploadcare File Uploader and Adaptive Delivery (beta)
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Uploadcare File Uploader and Adaptive Delivery (beta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Unauthorized modification of dataCVE-2024-4958 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_form_action' function in versions up to, and including, 3.2.0.1. This makes it possible for authenticated attackers, with contributor-level permissions and above, to import a registration form with a default user role of administrator. If an administrator approves or publishes a post or page with the shortcode to the imported form, any user can register as an administrator.
Product
User Registration – Custom Registration Form, Login Form, and User Profile
Affected
up to 3.2.0.1
What to do
Affects up to 3.2.0.1. Update User Registration – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 1, 2024Content Blocks (Custom Post Widget): Local File InclusionCVE-2024-3564 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'content_block' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 30, 2024Responsive Owl Carousel for Elementor: Local File InclusionCVE-2024-5345 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Owl Carousel for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.0 via the layout parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The inclusion is limited to PHP files.
Product
Responsive Owl Carousel for Elementor
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Responsive Owl Carousel for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2024WP STAGING WordPress Backup Plugin – Migration Backup Restore: Arbitrary file uploadsCVE-2024-3412 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP STAGING WordPress Backup Plugin – Migration Backup Restore
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update WP STAGING WordPress Backup Plugin – Migration Backup Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 24, 2024LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor: Stored Cross-Site ScriptingCVE-2024-5060 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.10.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor
Affected
up to 1.10.9
What to do
Affects up to 1.10.9. Update LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2024Hash Form – Drag & Drop Form Builder: Arbitrary file uploadsCVE-2024-5084 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2024ProfilePress: Stored Cross-Site ScriptingCVE-2024-2861 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ProfilePress
Affected
up to 4.15.8
What to do
Affects up to 4.15.8. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the serverCVE-2024-4388 · WordPress plugins & themes · reported by WPScanHigh 7.5
This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 22, 2024WPZOOM Addons for Elementor (Templates, Widgets): Local File InclusionCVE-2024-5147 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
WPZOOM Addons for Elementor (Templates, Widgets)
Affected
up to 1.1.37
What to do
Affects up to 1.1.37. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2024Salon booking system: Arbitrary file deletionCVE-2024-4442 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. This was partially patched in 9.9, and sufficiently patched in 10.0. CVE-2024-37231 appears to be a duplicate of this issue.
Product
Salon booking system
Affected
up to 9.8
What to do
Affects up to 9.8. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024Salient Core: Local File InclusionCVE-2024-3812 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_linea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Salient Core
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 18, 2024Salient Shortcodes: Local File InclusionCVE-2024-3810 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Salient Shortcodes
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Salient Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 17, 2024ActiveDEMAND: Unrestricted Upload of File with Dangerous TypeCVE-2024-32809 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: from n/a through 0.2.41.
Product
ActiveDEMAND
Affected
up to 0.2.41
What to do
Affects up to 0.2.41. Update ActiveDEMAND to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ProfileGrid: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32774 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affects ProfileGrid : from n/a through 5.8.2.
Product
ProfileGrid
Affected
up to 5.8.2
What to do
Affects up to 5.8.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Mailster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-32523 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.6.
Product
Mailster
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Profile Builder: Insufficient Verification of Data AuthenticityCVE-2024-31341 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from n/a through 3.11.2.
Product
Profile Builder
Affected
up to 3.11.2
What to do
Affects up to 3.11.2. Update Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Premmerce Permalink Manager for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-27971 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce woo-permalink-manager.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through <= 2.3.10.
Product
Premmerce Permalink Manager for WooCommerce
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update Premmerce Permalink Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WP Frontend Profile: Improper Privilege ManagementCVE-2023-51483 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Glowlogix WP Frontend Profile allows Privilege Escalation.This issue affects WP Frontend Profile: from n/a through 1.3.1.
Product
WP Frontend Profile
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP Frontend Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024XStore Core: Unrestricted Upload of File with Dangerous TypeCVE-2024-33556 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
Product
XStore Core
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Copymatic – AI Content Writer & Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-31351 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.6.
Product
Copymatic – AI Content Writer & Generator
Affected
up to 1.6
What to do
Affects up to 1.6. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ProfilePress: Improper Privilege ManagementCVE-2023-41954 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.
Product
ProfilePress
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JS Help Desk – Best Help Desk & Support: Unrestricted Upload of File with Dangerous TypeCVE-2023-25444 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024Penci Soledad Data Migrator: Local File InclusionCVE-2024-3551 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
Product
Penci Soledad Data Migrator
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Penci Soledad Data Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 15, 2024All-in-One Video Gallery: Local File InclusionCVE-2024-4670 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
All-in-One Video Gallery
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2024The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongingCVE-2024-3749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Kognetiks Chatbot for: Arbitrary file uploadsCVE-2024-4560 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upload_file_to_assistant function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers, with to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Kognetiks Chatbot for
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024XML Sitemap & Google News: Local File InclusionCVE-2024-4441 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
XML Sitemap & Google News
Affected
up to 5.4.8
What to do
Affects up to 5.4.8. Update XML Sitemap & Google News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024LearnPress – WordPress LMS: Arbitrary file uploadsCVE-2024-4397 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Porto Theme - Functionality: Local File InclusionCVE-2024-3809 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Porto Theme - Functionality
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Porto Theme - Functionality to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 14, 2024Porto Theme - Functionality: Local File InclusionCVE-2024-3808 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Porto Theme - Functionality
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Porto Theme - Functionality to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 14, 2024Porto: Local File InclusionCVE-2024-3807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. This was partially patched in version 7.1.0 and fully patched in version 7.1.1.
Product
Porto
Affected
up to 7.1.0
What to do
Affects up to 7.1.0. Update Porto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.