Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,905 results · page 63 of 79
Feb 1, 2024CRM Perks Forms – WordPress Form Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51536 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress Form Builder allows Stored XSS.This issue affects CRM Perks Forms – WordPress Form Builder: from n/a through 1.1.2.
- Product
- CRM Perks Forms – WordPress Form Builder
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update CRM Perks Forms – WordPress Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2024Keap Official Opt-in Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52192 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.
- Product
- Keap Official Opt-in Forms
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2024Formzu WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affects Formzu WP: from n/a through 1.6.7.
- Product
- Formzu WP
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Formzu WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Authorization Bypass Through User-Controlled KeyCVE-2024-22305 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
- Product
- Contact Form builder with drag & drop for WordPress – Kali Forms
- Affected
- up to 2.3.36
- What to do
- Affects up to 2.3.36. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 30, 2024Contact Form Entries: Arbitrary file uploadsCVE-2024-1069 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Contact Form Entries
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Contact Form Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2024Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: Stored Cross-Site ScriptingCVE-2024-0618 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordadvisory.abay.shplugins.trac.wordpress.org
Jan 26, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Cross-Site Request ForgeryCVE-2024-0667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or incorrect nonce validation on the 'execute' function. This makes it possible for unauthenticated attackers to execute arbitrary methods in the 'BoosterController' class via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Affected
- up to 1.15.21
- What to do
- Affects up to 1.15.21. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 26, 2024InstaWP Connect: Insertion of Sensitive Information Into Sent DataCVE-2024-23506 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
- Product
- InstaWP Connect
- Affected
- up to 0.1.0.9
- What to do
- Affects up to 0.1.0.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 26, 2024Image Source Control Lite – Show Image Credits and Captions: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52187 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite – Show Image Credits and Captions.This issue affects Image Source Control Lite – Show Image Credits and Captions: from n/a through 2.17.0.
- Product
- Image Source Control Lite – Show Image Credits and Captions
- Affected
- up to 2.17.0
- What to do
- Affects up to 2.17.0. Update Image Source Control Lite – Show Image Credits and Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024Profile Builder Pro: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-22141 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.
- Product
- Profile Builder Pro
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update Profile Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024WP Go Maps (formerly WP Google Maps): Reflected Cross-Site ScriptingCVE-2023-6697 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Go Maps (formerly WP Google Maps)
- Affected
- up to 9.0.28
- What to do
- Affects up to 9.0.28. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2024SalesKing: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-22154 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15.
- Product
- SalesKing
- Affected
- up to 1.6.15
- What to do
- Affects up to 1.6.15. Update SalesKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024Albo Pretorio On line: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-22301 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
- Product
- Albo Pretorio On line
- Affected
- up to 4.6.6
- What to do
- Affects up to 4.6.6. Update Albo Pretorio On line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024IP2Location Country Blocker: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-22294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Blocker: from n/a through 2.33.3.
- Product
- IP2Location Country Blocker
- Affected
- up to 2.33.3
- What to do
- Affects up to 2.33.3. Update IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024Contact Form 7 Extension For Mailchimp: Server-Side Request Forgery (SSRF)CVE-2024-22134 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
- Product
- Contact Form 7 Extension For Mailchimp
- Affected
- up to 0.5.70
- What to do
- Affects up to 0.5.70. Update Contact Form 7 Extension For Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 20, 2024WPForms Pro: Stored Cross-Site ScriptingCVE-2023-7063 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPForms Pro
- Affected
- up to 1.8.5.3
- What to do
- Affects up to 1.8.5.3. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpforms.comwordfence.com
Jan 19, 2024Wp Social Login and Register Social Counter: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-47160 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Login and Register Social Counter: from n/a through 1.9.0.
- Product
- Wp Social Login and Register Social Counter
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 19, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Deserialization of Untrusted DataCVE-2022-45083 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2022-41790 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.1.76
- What to do
- Affects up to 1.1.76. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 16, 2024Contact Form 7 Connector: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against administrators.
- Product
- Contact Form 7 Connector
- Fixed in
- 1.2.3
- What to do
- Update Contact Form 7 Connector to 1.2.3 or newer.
Jan 16, 2024Hubbub Lite (formerly Grow Social): Does not sanitise and escape some of its settingsCVE-2023-7154 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Hubbub Lite (formerly Grow Social)
- Fixed in
- 1.32.0
- What to do
- Update Hubbub Lite (formerly Grow Social) to 1.32.0 or newer.
Jan 16, 2024Contact Form by WD: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2655 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Contact Form by WD
- Affected
- up to 1.13.23
- What to do
- Affects up to 1.13.23. Update Contact Form by WD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Formidable Forms: Unserializes user inputCVE-2023-1405 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.
- Product
- Formidable Forms
- Fixed in
- 6.2
- What to do
- Update Formidable Forms to 6.2 or newer.
Jan 16, 2024Calculated Fields Form: Does not sanitise and escape some of its form settingsCVE-2023-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Calculated Fields Form
- Fixed in
- 1.1.151
- What to do
- Update Calculated Fields Form to 1.1.151 or newer.
Jan 16, 2024Contact Form Entries: Does not validate dataCVE-2022-3604 · WordPress plugins & themes · reported by WPScanHigh 7.8
The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.
- Product
- Contact Form Entries
- Fixed in
- 1.3.0
- What to do
- Update Contact Form Entries to 1.3.0 or newer.
Jan 16, 2024Contact Form & Lead Form Elementor Builder: Doesn't have authorisation and nonce checksCVE-2022-23180 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.7.4
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.7.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 16, 2024Contact Form & Lead Form Elementor Builder: Does not escape some of its form fields before outputting them in attributesCVE-2022-23179 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.7.0
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.7.0 or newer.
Jan 16, 2024Super Forms - Drag & Drop Form Builder: Does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX actionCVE-2022-0402 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.
- Product
- Super Forms - Drag & Drop Form Builder
- Fixed in
- 6.0.4
- What to do
- Update Super Forms - Drag & Drop Form Builder to 6.0.4 or newer.
Jan 15, 2024Keap Official Opt-in Forms: Does not sanitise and escape some of its settingsCVE-2023-6941 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Keap Official Opt-in Forms
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2024Easy Forms for Mailchimp: Does not sanitise and escape some of its settingsCVE-2023-4925 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Easy Forms for Mailchimp
- Affected
- up to 6.8.10
- What to do
- Affects up to 6.8.10. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2024Constant Contact Forms by MailMunch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22137 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.
- Product
- Constant Contact Forms by MailMunch
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update Constant Contact Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 11, 2024Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder: Stored Cross-Site ScriptingCVE-2023-6828 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 11, 2024ElementsKit Elementor addons: Sensitive Information ExposureCVE-2023-6582 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only.
- Product
- ElementsKit Elementor addons
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized access of dataCVE-2023-6504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.
- Product
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected
- up to 3.10.7
- What to do
- Affects up to 3.10.7. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 11, 2024MW WP Form: Arbitrary file uploadsCVE-2023-6316 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- MW WP Form
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2024Piotnet Forms: Arbitrary file uploadsCVE-2023-6220 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms_ajax_form_builder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Piotnet Forms
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2024Calculated Fields Form: Stored Cross-Site ScriptingCVE-2023-6446 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Calculated Fields Form
- Affected
- up to 1.2.40
- What to do
- Affects up to 1.2.40. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 11, 2024Contact Form 7 – Dynamic Text Extension: Insecure Direct Object ReferenceCVE-2023-6630 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
- Product
- Contact Form 7 – Dynamic Text Extension
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Contact Form 7 – Dynamic Text Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2023-6842 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions.
- Product
- Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2024Formidable Forms: HTML injectionCVE-2023-6830 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. CVE-2024-23522 appears to be a duplicate of this issue.
- Product
- Formidable Forms
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2024Metform Elementor Contact Form Builder: Cross-Site Request ForgeryCVE-2023-6788 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options "mf_hubsopt_token", "mf_hubsopt_refresh_token", "mf_hubsopt_token_type", and "mf_hubsopt_expires_in" via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This would allow an attacker to connect their own Hubspot account to a victim site's metform to obtain leads and contacts.
- Product
- Metform Elementor Contact Form Builder
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2024Advanced Custom Fields (ACF): Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-40696 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
- Product
- Advanced Custom Fields (ACF)
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update Advanced Custom Fields (ACF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, DynamiCVE-2022-34344 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Database Cleaner: Clean, Optimize & Repair: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.
- Product
- Database Cleaner: Clean, Optimize & Repair
- Affected
- up to 0.9.8
- What to do
- Affects up to 0.9.8. Update Database Cleaner: Clean, Optimize & Repair to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Defender Security – Malware Scanner, Login Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
- Product
- Defender Security – Malware Scanner, Login Security & Firewall
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Defender Security – Malware Scanner, Login Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.
- Product
- WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024FastDup – Fastest WordPress Migration & Duplicator: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51406 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.
- Product
- FastDup – Fastest WordPress Migration & Duplicator
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update FastDup – Fastest WordPress Migration & Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Download Monitor: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-45354 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.
- Product
- Download Monitor
- Affected
- up to 4.7.60
- What to do
- Affects up to 4.7.60. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024cformsII: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52203 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.
- Product
- cformsII
- Affected
- up to 15.0.5
- What to do
- Affects up to 15.0.5. Update cformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Clone: Uses buffer files to store in-progress backup informationsCVE-2023-6750 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.
- Product
- Clone
- Fixed in
- 2.4.3
- What to do
- Update Clone to 2.4.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.