Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

534new WordPress flaws this week

391,528entries in the database

4,612 results · page 65 of 93

Sep 11, 2024WooCommerce Photo Reviews Premium: Authentication bypassCVE-2024-8277 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully.
Product
WooCommerce Photo Reviews Premium
Affected
up to 1.3.13.2
What to do
Affects up to 1.3.13.2. Update WooCommerce Photo Reviews Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 11, 2024HTML5 Video Player – mp4 Video Player Plugin and Block: Unauthorized modification of dataCVE-2024-7721 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled.
Product
HTML5 Video Player – mp4 Video Player Plugin and Block
Affected
up to 2.5.34
What to do
Affects up to 2.5.34. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Opti Marketing
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
TrueBooker
Fixed in
1.0.3
What to do
Update TrueBooker to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 6, 2024Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized modification of dataCVE-2024-8427 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.
Product
Frontend Post Submission Manager Lite – Frontend Posting
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Frontend Post Submission Manager Lite – Frontend Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Image Optimizer, Resizer and CDN – Sirv: Unauthorized modification of dataCVE-2024-8480 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sirv_save_prevented_sizes' function in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to exploit the 'sirv_upload_file_by_chunks_callback' function, which lacks proper file type validation, allowing attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024HelloAsso: Unauthorized modification of dataCVE-2024-7605 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versions up to, and including, 1.1.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to update plugin options, potentially disrupting the service.
Product
HelloAsso
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024Form Vibes – Database Manager for Forms: Unauthorized access of data and modification of dataCVE-2024-5309 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_data, get_event_logs_data, delete_submissions, and get_submissions functions in all versions up to, and including, 1.4.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple unauthorized actions. NOTE: This vulnerability is partially fixed in version 1.4.12.
Product
Form Vibes – Database Manager for Forms
Affected
up to 1.4.12
Fixed in
1.4.12
What to do
Update Form Vibes – Database Manager for Forms to 1.4.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of user namesCVE-2024-8121 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change_admin_name() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change an admin's username to a username of their liking as long as the default 'admin' was used.
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of data that can lead to privilege escalationCVE-2024-8102 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_ajax() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024Viral Signup: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6926 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Viral Signup
Affected
up to 2.1
What to do
Affects up to 2.1. Update Viral Signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 31, 2024Web Application Firewall: IP Address SpoofingCVE-2022-4539 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
Product
Web Application Firewall
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Web Application Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2024Maintenance & Coming Soon Redirect Animation: Authentication Bypass by SpoofingCVE-2024-43944 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: from n/a through <= 2.3.3.
Product
Maintenance & Coming Soon Redirect Animation
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024WP Accessibility Helper (WAH): Unauthorized modification of dataCVE-2024-5987 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contrast_variations' and 'save_empty_contrast_variations' functions in all versions up to, and including, 0.6.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these issues were patched in 0.6.2.8, though it broke functionality and the vendor has not responded to our follow-ups.
Product
WP Accessibility Helper (WAH)
Affected
up to 0.6.2.8
What to do
Affects up to 0.6.2.8. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 28, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: Unauthorized modification of dataCVE-2024-7447 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to upload arbitrary media to the site, even if no forms exist.
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Affected
up to 3.7.3.2
What to do
Affects up to 3.7.3.2. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Unauthorized modification of dataCVE-2024-8199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update API Key options.
Product
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Oxygen Builder: Unauthorized modification of dataCVE-2024-6688 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.
Product
Oxygen Builder
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record oxygenbuilder.com wordfence.com
Aug 26, 2024Store Locator Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.
Product
Store Locator Plus
Affected
up to 2311.17.01
What to do
Affects up to 2311.17.01. Update Store Locator Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-6631 · WordPress plugins & themes · reported by WordfenceMedium 5
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2024String locator: Reflected Cross-Site ScriptingCVE-2023-6987 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This required WP_DEBUG to be enabled in order to be exploited.
Product
String locator
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update String locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024Themify Builder: Unauthorized post duplicationCVE-2024-7836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.
Product
Themify Builder
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024WP Testimonial Widget: Unauthorized modification of dataCVE-2024-7390 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrder function in all versions up to, and including, 3.1. This makes it possible for unauthenticated attackers to change the order of testimonials.
Product
WP Testimonial Widget
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024Smart Online Order for Clover: Unauthorized modification of dataCVE-2024-7030 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update product and category descriptions, category titles and images, and sort order.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2024Event Espresso 4 Decaf – Event Registration Event Ticketing: Limited unauthorized plugin settings modificationCVE-2024-6883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.
Product
Event Espresso 4 Decaf – Event Registration Event Ticketing
Affected
up to 4.10.46.decaf
What to do
Affects up to 4.10.46.decaf. Update Event Espresso 4 Decaf – Event Registration Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2024-5940 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024Icegram: Missing Authentication for Critical FunctionCVE-2024-43272 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24.
Product
Icegram
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Ultimate Membership Pro: Improper AuthenticationCVE-2024-43240 · WordPress plugins & themes · reported by PatchstackCritical 9.4
Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.
Product
Ultimate Membership Pro
Affected
up to 12.7
What to do
Affects up to 12.7. Update Ultimate Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024GEO my WP: Does not prevent unauthenticated attackers from including arbitrary files in PHP's execution contextCVE-2024-6330 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
Product
GEO my WP
Fixed in
4.5.0.2
What to do
Update GEO my WP to 4.5.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 17, 2024LadiApp plugn: Unauthorized modification of dataCVE-2023-4730 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.
Product
LadiApp plugn
Affected
up to 4.3
What to do
Affects up to 4.3. Update LadiApp plugn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4027 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4025 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4024 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 14, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-7628 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.2
What to do
Affects up to 4.15.2. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2024Slider by Soliloquy: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper AuthenticationCVE-2024-35775 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by Soliloquy allows Cross-Site Scripting (XSS).This issue affects Slider by Soliloquy: from n/a through 2.7.6.
Product
Slider by Soliloquy
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Slider by Soliloquy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized modification of dataCVE-2024-7621 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_wpfeedback_misc_options() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings which can also be leveraged to gain access to the plugin's settings.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2024WooCommerce - Social Login: Authentication bypassCVE-2024-7503 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.
Product
WooCommerce - Social Login
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 12, 2024Obfuscate Email: Full Path DisclosureCVE-2024-7413 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Obfuscate Email
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update Obfuscate Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 12, 2024Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget: Does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the WCVE-2024-6158 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget
Fixed in
4.9.17
What to do
Update Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget to 4.9.17 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2024Premium Addons for Elementor: Unauthorized modification and loss of dataCVE-2024-6824 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'check_temp_validity' and 'update_template_title' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles.
Product
Premium Addons for Elementor
Affected
up to 4.10.38
What to do
Affects up to 4.10.38. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2024Orchid Store: Unauthorized modification of dataCVE-2024-6987 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Addonify Floating Cart For WooCommerce plugin if it is installed.
Product
Orchid Store
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Aug 8, 2024Falang multilanguage for: Unauthorized modification of dataCVE-2024-6869 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete translations and expose the administrator email address.
Product
Falang multilanguage for
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update Falang multilanguage for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2024Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress: Authentication bypassCVE-2024-7350 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.
Product
Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress
Affected
1.1.6 to 1.1.7
What to do
Affects 1.1.6 to 1.1.7. Update Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2024Sync Post With Other Site: Unauthorized modification of dataCVE-2024-6709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_post' function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new draft posts and update existing posts.
Product
Sync Post With Other Site
Affected
up to 1.6
What to do
Affects up to 1.6. Update Sync Post With Other Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-7031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.
Product
File Manager Pro – Filester
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-4090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.7.2
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2024WP Mobile Menu: Unauthorized modification of dataCVE-2024-2508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.
Product
WP Mobile Menu
Affected
up to 2.8.4.4
What to do
Affects up to 2.8.4.4. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
CZ Loan Management
Affected
up to 1.1
What to do
Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
WpStickyBar
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2024The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PCVE-2024-5882 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page
Product
Ultimate Classified Listings
Fixed in
1.3
What to do
Update Ultimate Classified Listings to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 27, 2024WooCommerce Product Table Lite: Unauthorized post title modificationCVE-2024-6458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.
Product
WooCommerce Product Table Lite
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.