Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
596 results · page 8 of 12
Apr 15, 2024Simple Buttons Creator: Does not have CSRF checks in some placesCVE-2024-2858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Simple Buttons Creator
- Affected
- up to 1.04
- What to do
- Affects up to 1.04. Update Simple Buttons Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Advanced Search: Does not have CSRF checks in some placesCVE-2024-2739 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Advanced Search
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024NPS computy: Does not have CSRF checks in some placesCVE-2024-1755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Smart Forms: Does not have CSRF checks in some placesCVE-2024-1306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
- Product
- Smart Forms
- Fixed in
- 2.6.94
- What to do
- Update Smart Forms to 2.6.94 or newer.
Apr 10, 2024WordPress Ping Optimizer: Does not have CSRF checks in some placesCVE-2023-6385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs.
- Product
- WordPress Ping Optimizer
- Affected
- up to 2.35.1.3.0
- What to do
- Affects up to 2.35.1.3.0. Update WordPress Ping Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 29, 2024WC Marketplace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3.
- Product
- WC Marketplace
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update WC Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2024Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: from n/a through 4.5.24.
- Product
- Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more
- Affected
- up to 4.5.24
- What to do
- Affects up to 4.5.24. Update Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.1
- What to do
- Update CM Download Manager to 2.9.1 or newer.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1232 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.0
- What to do
- Update CM Download Manager to 2.9.0 or newer.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1231 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.0
- What to do
- Update CM Download Manager to 2.9.0 or newer.
Mar 20, 2024Word Replacer Pro: Missing AuthorizationCVE-2023-52229 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0.
- Product
- Word Replacer Pro
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Word Replacer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2024Appointment Booking Calendar: Does not have CSRF checks in some placesCVE-2024-0856 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.
- Product
- Appointment Booking Calendar
- Fixed in
- 1.3.83
- What to do
- Update Appointment Booking Calendar to 1.3.83 or newer.
Mar 20, 2024Travelpayouts: All Travel Brands in One Place: Is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variableCVE-2024-0337 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Travelpayouts: All Travel Brands in One Place
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Travelpayouts: All Travel Brands in One Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Innovs HR: Does not have CSRF checks in some placesCVE-2024-0858 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
- Product
- Innovs HR
- Fixed in
- 1.0.3.7.1
- What to do
- Update Innovs HR to 1.0.3.7.1 or newer.
Mar 16, 2024Word Replacer Pro: Unauthorized modification of dataCVE-2024-1733 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_replacer_ultra() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update arbitrary content on the affected WordPress site.
- Product
- Word Replacer Pro
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Word Replacer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 12, 2024Splashscreen: Does not have CSRF check in placeCVE-2023-6501 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Splashscreen
- Affected
- up to 0.20
- What to do
- Affects up to 0.20. Update Splashscreen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Feb 12, 2024lasTunes: Does not have CSRF check in some placesCVE-2023-6499 · WordPress plugins & themes · reported by WPScanMedium 5.4
The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- lasTunes
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update lasTunes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 5, 2024Better Search Replace: PHP Object InjectionCVE-2023-6933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Better Search Replace
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Better Search Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 29, 2024WP SOCIAL BOOKMARK MENU: Does not have CSRF check in placeCVE-2023-7074 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WP SOCIAL BOOKMARK MENU
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP SOCIAL BOOKMARK MENU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Autotitle for: Does not have CSRF check in placeCVE-2023-6946 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Autotitle for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Autotitle for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024WP Plugin Lister: Does not have CSRF check in some placesCVE-2023-6503 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Plugin Lister
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Plugin Lister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Custom User CSS: Does not have CSRF check in placeCVE-2023-6391 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Custom User CSS
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Custom User CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024WordPress Users: Does not have CSRF check in placeCVE-2023-6390 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WordPress Users
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 22, 2024Product Enquiry for WooCommerce: Does not have a CSRF check in placeCVE-2023-6625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 16, 2024Voting Record: Does not have CSRF check in some placesCVE-2023-7083 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Voting Record
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Voting Record to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 16, 2024ArtPlacer Widget: Does not sanitize and escape the "id" parameter before submitting the queryCVE-2023-6373 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
- Product
- ArtPlacer Widget
- Fixed in
- 2.20.7
- What to do
- Update ArtPlacer Widget to 2.20.7 or newer.
Jan 16, 2024Ecwid Ecommerce Shopping Cart: Does not have CSRF check in placeCVE-2023-6292 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Ecwid Ecommerce Shopping Cart
- Fixed in
- 6.12.5
- What to do
- Update Ecwid Ecommerce Shopping Cart to 6.12.5 or newer.
Jan 16, 2024User registration & user profile: Does not have CSRF check in some placesCVE-2023-0824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
- Product
- User registration & user profile
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update User registration & user profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Core Control: Does not have CSRF check in placeCVE-2022-1760 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Core Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Core Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Coru LFMember: Does not have CSRF check in placeCVE-2022-1618 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in their settings, allowing attacker to make a logged in admin add an arbitrary game with XSS payloads
- Product
- Coru LFMember
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Coru LFMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024WP-Invoice: Does not have CSRF check in placeCVE-2022-1617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them
- Product
- WP-Invoice
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2024Enable Media Replace: Reflected Cross-Site ScriptingCVE-2023-6737 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploiting this vulnerability requires the attacker to know the ID of an attachment uploaded by the user they are attacking.
- Product
- Enable Media Replace
- Affected
- up to 4.1.4
- What to do
- Affects up to 4.1.4. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 11, 2024WCFM Marketplace: Stored Cross-Site ScriptingCVE-2023-4960 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WCFM Marketplace
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2024CommentTweets: Does not have CSRF checks in some placesCVE-2023-6845 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- CommentTweets
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update CommentTweets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 8, 2024WP Blogs' Planetarium: Does not have CSRF check in placeCVE-2023-6532 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Blogs' Planetarium
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Blogs' Planetarium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger CVE-2023-51371 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS.This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.
- Product
- Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- Affected
- up to 3.7.12
- What to do
- Affects up to 3.7.12. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48327 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors.This issue affects WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors: from n/a through 2.4.7.
- Product
- WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Deserialization of Untrusted DataCVE-2023-34382 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
- Product
- Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- Affected
- up to 3.7.19
- What to do
- Affects up to 3.7.19. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
- Product
- Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
- Affected
- up to 6.4.5
- What to do
- Affects up to 6.4.5. Update Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Thumbs Rating: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2022-45809 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.0.0.
- Product
- Thumbs Rating
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Thumbs Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023YASR – Yet Another Star Rating Plugin for: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2023-37867 · WordPress plugins & themes · reported by PatchstackLow 3.7
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.
- Product
- YASR – Yet Another Star Rating Plugin for
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update YASR – Yet Another Star Rating Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.CVE-2023-28749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- What to do
- Update the plugin to the newest version.
Nov 14, 2023YOP Poll: A race conditionCVE-2023-6109 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.
- Product
- YOP Poll
- Affected
- up to 6.5.26
- What to do
- Affects up to 6.5.26. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 26, 2023Conversios Track Google Analytics 4, Facebook Pixel & Conversions API: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-46094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
- Product
- Conversios Track Google Analytics 4, Facebook Pixel & Conversions API
- Fixed in
- 6.5.4
- What to do
- Update Conversios Track Google Analytics 4, Facebook Pixel & Conversions API to 6.5.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Live Chat with Facebook Messenger: Stored Cross-Site ScriptingCVE-2023-5740 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Live Chat with Facebook Messenger
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Live Chat with Facebook Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023Photospace Responsive: Stored Cross-Site ScriptingCVE-2023-4271 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Photospace Responsive
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2023Enable Media Replace: Unserializes user input via the Remove Background featureCVE-2023-4643 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
- Product
- Enable Media Replace
- Fixed in
- 4.1.3
- What to do
- Update Enable Media Replace to 4.1.3 or newer.
Sep 14, 2023WS Facebook Like Box Widget: Stored Cross-Site ScriptingCVE-2023-4963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WS Facebook Like Box Widget
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update WS Facebook Like Box Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.