Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

541new WordPress flaws this week

391,528entries in the database

4,612 results · page 64 of 93

Oct 16, 2024NinjaFirewall: Authenticated PHAR DeserializationCVE-2021-4451 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).
Product
NinjaFirewall
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update NinjaFirewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Oct 16, 2024ThemeGrill Demo Importer: Authentication bypassCVE-2020-36837 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become automatically logged in as an administrator.
Product
ThemeGrill Demo Importer
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update ThemeGrill Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record raw.githubusercontent.com openwall.com
Oct 16, 2024Ultimate Membership Pro: Authentication BypassCVE-2020-36832 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
Product
Ultimate Membership Pro
What to do
Update Ultimate Membership Pro to the newest version.
Full record and what to do →NVD record codecanyon.net wpscan.com
Oct 16, 2024Advanced Access Manager: Unauthenticated Arbitrary File ReadCVE-2019-25213 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php
Product
Advanced Access Manager
Affected
up to 5.9.8.1
What to do
Affects up to 5.9.8.1. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2024Locatoraid Store Locator: Reflected Cross-Site ScriptingCVE-2024-9652 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Locatoraid Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST keys in all versions up to, and including, 3.9.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Locatoraid Store Locator
Affected
up to 3.9.47
What to do
Affects up to 3.9.47. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024UltimateAI: Authentication bypassCVE-2024-9105 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This is due to insufficient verification on the user being supplied in the 'ultimate_ai_register_or_login_with_google' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
UltimateAI
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update UltimateAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 15, 2024UltimateAI: Authentication bypassCVE-2024-9104 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimate_ai_change_pass' function. This makes it possible for unauthenticated attackers to reset the password of the first user, whose account is not yet activated or the first user who activated their account, who are subscribers.
Product
UltimateAI
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update UltimateAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 14, 2024WP 2FA with Telegram: Two-Factor Authentication BypassCVE-2024-9820 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.
Product
WP 2FA with Telegram
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2024WP 2FA with Telegram: Authentication BypassCVE-2024-9687 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
Product
WP 2FA with Telegram
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024Category Icon: Stored Cross-Site ScriptingCVE-2024-8915 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Category Icon
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024ImagePress – Image Gallery: Unauthorized modification and loss of dataCVE-2024-9824 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_delete_post' and 'ip_update_post_title' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts and update post titles.
Product
ImagePress – Image Gallery
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024Forms for Mailchimp by Optin Cat – Grow Your MailChimp List: Stored Cross-Site ScriptingCVE-2024-7489 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forms for Mailchimp by Optin Cat – Grow Your MailChimp List
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Forms for Mailchimp by Optin Cat – Grow Your MailChimp List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Bridge Core: Unauthorized modification of data or loss of dataCVE-2024-9860 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action' and 'install_plugin_per_demo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with subscriber-level permissions or above, to delete or change plugin settings, import demo data, and install limited plugins.
Product
Bridge Core
Affected
up to 3.3
What to do
Affects up to 3.3. Update Bridge Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 11, 2024Easy PayPal Gift Certificate: Cross-Site Request ForgeryCVE-2024-9592 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgc_plugin_options' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy PayPal Gift Certificate
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Easy PayPal Gift Certificate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2024Linkz.ai: Unauthorized modification of dataCVE-2024-9587 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions up to, and including, 1.1.8. This makes it possible for authenticated attackers with contributor-level privileges or above, to update plugin settings.
Product
Linkz.ai
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Linkz.ai to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Linkz.ai: Unauthorized modification of dataCVE-2024-9586 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' functions in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update plugin settings.
Product
Linkz.ai
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Linkz.ai to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Reflected Cross-Site ScriptingCVE-2024-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Affected
up to 3.5.14
What to do
Affects up to 3.5.14. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2024Pedalo Connector: Authentication bypassCVE-2024-9822 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.
Product
Pedalo Connector
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Pedalo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024UserPlus: Unauthorized access, modification, and loss of dataCVE-2024-9520 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to add, modify, or delete user meta and plugin options.
Product
UserPlus
Affected
up to 2.0
What to do
Affects up to 2.0. Update UserPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized modification of dataCVE-2024-9067 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Notification for Telegram: Unauthorized test message sendingCVE-2024-9685 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_action' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a test message via the Telegram Bot API to all users configured in the settings.
Product
Notification for Telegram
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024WP Users Masquerade: Authentication bypassCVE-2024-9522 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
Product
WP Users Masquerade
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Users Masquerade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024UserPlus: Unauthorized modification of dataCVE-2024-9519 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads to privilege escalation.
Product
UserPlus
Affected
up to 2.0
What to do
Affects up to 2.0. Update UserPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024WP Helper Premium: Unauthorized modification of dataCVE-2024-9065 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_smtp_send_mail_test' function in all versions up to, and including, 4.6.1. This makes it possible for unauthenticated attackers to send emails containing any content and originating from the vulnerable WordPress instance to any recipient. CVE-2025-24737 is likely a duplicate of this issue.
Product
WP Helper Premium
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update WP Helper Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages: Unauthorized modification of dataCVE-2024-8513 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_config() function in all versions up to, and including, 4.1.1.1. This makes it possible for unauthenticated attackers to update the plugin's settings.
Product
QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages
Affected
up to 4.1.1.1
What to do
Affects up to 4.1.1.1. Update QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024LatePoint: Authentication bypassCVE-2024-8943 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13.
Product
LatePoint
Fixed in
5.0.13
What to do
Update LatePoint to 5.0.13 or newer.
Full record and what to do →NVD record wpdocs.latepoint.com wordfence.com
Oct 6, 2024Catch Base: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47313 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Catch Base catch-base allows Stored XSS.This issue affects Catch Base: from n/a through <= 3.4.6.
Product
Catch Base
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Catch Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024WP Mail Catcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47339 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JWardee WP Mail Catcher wp-mail-catcher allows Reflected XSS.This issue affects WP Mail Catcher: from n/a through <= 2.1.9.
Product
WP Mail Catcher
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.5.
Product
Automatically Hierarchic Categories in Menu
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized modification and loss of dataCVE-2024-9161 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.228
What to do
Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024WordPress & WooCommerce Affiliate Program: Authentication bypassCVE-2024-9289 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's email.
Product
WordPress & WooCommerce Affiliate Program
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update WordPress & WooCommerce Affiliate Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 1, 2024Spice Starter Sites: Unauthorized modification of dataCVE-2024-8430 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.
Product
Spice Starter Sites
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Spice Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024LocateAndFilter: Stored Cross-Site ScriptingCVE-2024-9304 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LocateAndFilter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
LocateAndFilter
Affected
up to 1.6.14
What to do
Affects up to 1.6.14. Update LocateAndFilter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 1, 2024Wechat Social login: Authentication bypassCVE-2024-9106 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This is only exploitable if the app secret is not set, so it has a default empty value.
Product
Wechat Social login
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024Soumettre.fr: Unauthorized modification of dataCVE-2024-8675 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_disconnect_gateway function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the gateway and delete the API key.
Product
Soumettre.fr
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Soumettre.fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024KB Support – WordPress Help Desk and Knowledge Base: Unauthorized access and modification of dataCVE-2024-8632 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'kbs_ajax_load_front_end_replies' and 'kbs_ajax_mark_reply_as_read' functions in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to read replies of any ticket, and mark any reply as read.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024KB Support – WordPress Help Desk and Knowledge Base: Unauthorized modification and loss of dataCVE-2024-8548 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /includes/ajax-functions.php file all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2024EU/UK VAT Manager for WooCommerce: Unauthorized modification of dataCVE-2024-9189 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.
Product
EU/UK VAT Manager for WooCommerce
Affected
up to 2.12.12
What to do
Affects up to 2.12.12. Update EU/UK VAT Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 27, 2024Product Enquiry for WooCommerce, WooCommerce product catalog: PHP Object InjectionCVE-2024-8922 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.33.32 via deserialization of untrusted input in enquiry_detail.php. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Product Enquiry for WooCommerce, WooCommerce product catalog
Affected
up to 2.2.33.32
What to do
Affects up to 2.2.33.32. Update Product Enquiry for WooCommerce, WooCommerce product catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2CVE-2024-7714 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2024Jupiter X Core: Authentication bypassCVE-2024-7781 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Login widget. This makes it possible for unauthenticated attackers to log in as the first user to have logged in with a social media account, including administrator accounts. Attackers can exploit the vulnerability even if the Social Login element has been disabled, as long as it was previously enabled and used. The vulnerability was partially patched in version 4.7.5, and fully patched in version 4.7.8.
Product
Jupiter X Core
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2024Download Monitor: Unauthorized modification of dataCVE-2024-8552 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.
Product
Download Monitor
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2024Revolut Gateway for WooCommerce: Unauthorized modification of dataCVE-2024-8678 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders as completed.
Product
Revolut Gateway for WooCommerce
Affected
up to 4.17.3
What to do
Affects up to 4.17.3. Update Revolut Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2024WP Category Dropdown: Stored Cross-Site ScriptingCVE-2024-8103 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Category Dropdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Category Dropdown
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Category Dropdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024Pixel Cat – Conversion Pixel Manager: Reflected Cross-Site ScriptingCVE-2024-8544 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pixel Cat – Conversion Pixel Manager
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Pixel Cat – Conversion Pixel Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024Appointment & Event Booking Calendar Plugin – Webba Booking: Unauthorized modification of dataCVE-2024-8432 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_appearance() function in all versions up to, and including, 5.0.48. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the booking form's CSS.
Product
Appointment & Event Booking Calendar Plugin – Webba Booking
Affected
up to 5.0.48
What to do
Affects up to 5.0.48. Update Appointment & Event Booking Calendar Plugin – Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2024Maintenance Redirect: Authentication Bypass by SpoofingCVE-2024-45453 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from n/a through <= 2.0.1.
Product
Maintenance Redirect
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Maintenance Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 13, 2024Email Obfuscate Shortcode: Stored Cross-Site ScriptingCVE-2024-8747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Obfuscate Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Email Obfuscate Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 13, 2024Delicate: Stored Cross-Site ScriptingCVE-2024-5867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Delicate
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Delicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not validate and escape some of its settings before outputting them back in the pageCVE-2024-7133 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks.
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.7.3
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.3 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.