Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

783 results · page 9 of 16

Nov 9, 2024SrcSet Responsive Images for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ben.moody SrcSet Responsive Images for WordPress truenorth-srcset allows Reflected XSS.This issue affects SrcSet Responsive Images for WordPress: from n/a through <= 1.4.
Product
SrcSet Responsive Images for
Affected
up to 1.4
What to do
Affects up to 1.4. Update SrcSet Responsive Images for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Daily Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Hotchkiss Daily Image daily-image allows Reflected XSS.This issue affects Daily Image: from n/a through <= 1.0.
Product
Daily Image
Affected
up to 1.0
What to do
Affects up to 1.0. Update Daily Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Time-based SQL InjectionCVE-2024-9874 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 6, 2024Wp-ImageZoom: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2024-9934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Wp-ImageZoom
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Wp-ImageZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 5, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2024-9878 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.30
What to do
Affects up to 1.8.30. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 1, 2024ShortPixel Image Optimizer: Missing AuthorizationCVE-2024-48044 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
Product
ShortPixel Image Optimizer
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Robin image optimizer: Missing AuthorizationCVE-2024-43122 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Creative Motion Robin image optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robin image optimizer: from n/a through 1.6.9.
Product
Robin image optimizer
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Robin image optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Auto Featured Image (Auto Post Thumbnail): Missing AuthorizationCVE-2024-38719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.1.2.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37516 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.2.
Product
Featured Image from URL
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.
Product
Featured Image from URL
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024CWD 3D Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery allows Reflection Injection.This issue affects CWD 3D Image Gallery: from n/a through <= 1.0.
Product
CWD 3D Image Gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update CWD 3D Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Generic SQL InjectionCVE-2024-9475 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Stored Cross-Site ScriptingCVE-2024-9462 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions up to, and including, 5.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2024Image Map Pro: Stored Cross-Site ScriptingCVE-2024-9585 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with an arbitrary shortcode in versions up to, and including, 6.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Map Pro
Affected
up to 6.0.20
What to do
Affects up to 6.0.20. Update Image Map Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record imagemappro.com wordfence.com
Oct 25, 2024Image Map Pro: Unauthorized modification of data and loss of dataCVE-2024-9584 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or above, to add, update or delete map projects.
Product
Image Map Pro
Affected
up to 6.0.20
What to do
Affects up to 6.0.20. Update Image Map Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record imagemappro.com wordfence.com
Oct 23, 2024AI Image Generator for Your Content & Featured Images – AI Postpix: Unrestricted Upload of File with Dangerous TypeCVE-2024-49671 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix ai-postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through <= 1.1.8.
Product
AI Image Generator for Your Content & Featured Images – AI Postpix
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update AI Image Generator for Your Content & Featured Images – AI Postpix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2024Category and Taxonomy Image: Stored Cross-Site ScriptingCVE-2024-9591 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Category and Taxonomy Image
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2024WordPress Image SEO: Cross-Site Request Forgery (CSRF)CVE-2024-49627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from n/a through 1.1.4.
Product
WordPress Image SEO
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WordPress Image SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024Advanced Category and Custom Taxonomy Image: Stored Cross-Site ScriptingCVE-2024-9425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_image shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Category and Custom Taxonomy Image
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Advanced Category and Custom Taxonomy Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2024Bulk images optimizer: Resize, optimize, convert to webp, rename …: Unauthorized modification of dataCVE-2024-9361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_configuration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options.
Product
Bulk images optimizer: Resize, optimize, convert to webp, rename …
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Bulk images optimizer: Resize, optimize, convert to webp, rename … to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 17, 2024ShortPixel Image Optimizer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48043 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
Product
ShortPixel Image Optimizer
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-9898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Parallax Image
Affected
up to 1.8
What to do
Affects up to 1.8. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024WordPress Gallery Plugin – Limb Image Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2024-49260 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
Product
WordPress Gallery Plugin – Limb Image Gallery
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update WordPress Gallery Plugin – Limb Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024WordPress Gallery Plugin – Limb Image Gallery: Path Traversal: '.../...//'CVE-2024-49258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
Product
WordPress Gallery Plugin – Limb Image Gallery
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update WordPress Gallery Plugin – Limb Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Ahime Image Printer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
Product
Ahime Image Printer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ahime Image Printer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024ACF Images Search And Insert: Unrestricted Upload of File with Dangerous TypeCVE-2024-48035 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through <= 1.1.4.
Product
ACF Images Search And Insert
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update ACF Images Search And Insert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024External featured image from bing: Unrestricted Upload of File with Dangerous TypeCVE-2024-48027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a Web Shell to a Web Server.This issue affects External featured image from bing: from n/a through <= 1.0.2.
Product
External featured image from bing
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update External featured image from bing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 12, 2024ImagePress – Image Gallery: Unauthorized modification and loss of dataCVE-2024-9824 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_delete_post' and 'ip_update_post_title' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts and update post titles.
Product
ImagePress – Image Gallery
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024ImagePress – Image Gallery: Cross-Site Request ForgeryCVE-2024-9778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the 'imagepress_admin_page' function. This makes it possible for unauthenticated attackers to update plugin settings, including redirection URLs, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ImagePress – Image Gallery
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024ImagePress – Image Gallery: Stored Cross-Site ScriptingCVE-2024-9776 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ImagePress – Image Gallery
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024TS Poll – Survey, Versus Poll, Image Poll, Video Poll: SQL InjectionCVE-2024-9022 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update TS Poll – Survey, Versus Poll, Image Poll, Video Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Oct 8, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Unauthorized access of dataCVE-2024-8431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024Image Optimizer, Resizer and CDN – Sirv: Stored Cross-Site ScriptingCVE-2024-8964 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.9
What to do
Affects up to 7.2.9. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 6, 2024Share This Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47326 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Share This Image share-this-image allows Reflected XSS.This issue affects Share This Image: from n/a through <= 2.01.
Product
Share This Image
Affected
up to 2.01
What to do
Affects up to 2.01. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2024BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Reflected Cross-Site ScriptingCVE-2024-9344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2024RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more: Reflected Cross-Site ScriptingCVE-2024-8800 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.21.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more
Affected
up to 2.21.0
What to do
Affects up to 2.21.0. Update RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024PDF Image Generator: Reflected Cross-Site ScriptingCVE-2024-9241 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Image Generator
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update PDF Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024Auto Featured Image from Title: Reflected Cross-Site ScriptingCVE-2024-8786 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Auto Featured Image from Title
Affected
up to 2.3
What to do
Affects up to 2.3. Update Auto Featured Image from Title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Sight – Professional Image Gallery and Portfolio: Unauthorized access of dataCVE-2024-9025 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.
Product
Sight – Professional Image Gallery and Portfolio
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Sight – Professional Image Gallery and Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2024Justified Image Grid: Server-Side Request Forgery (SSRF)CVE-2024-43989 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <= 4.6.1.
Product
Justified Image Grid
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Justified Image Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Share This Image: Open RedirectCVE-2024-8761 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on the redirect url supplied via the link parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
Share This Image
Affected
up to 2.03
What to do
Affects up to 2.03. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2024Accordion Image Menu: Does not have CSRF check in some placesCVE-2024-8092 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Accordion Image Menu
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Accordion Image Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2024Gallery Plugin for WordPress: Does not sanitise and escape some of its image settingsCVE-2024-3899 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.
Product
Gallery Plugin for WordPress
Fixed in
1.8.15
What to do
Update Gallery Plugin for WordPress to 1.8.15 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2024Slider comparison image before and after: Stored Cross-Site ScriptingCVE-2024-8543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider comparison image before and after
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Slider comparison image before and after to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2024Image Optimizer, Resizer and CDN – Sirv: Unauthorized modification of dataCVE-2024-8480 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sirv_save_prevented_sizes' function in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to exploit the 'sirv_upload_file_by_chunks_callback' function, which lacks proper file type validation, allowing attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024Dynamic Featured Image: Stored Cross-Site ScriptingCVE-2024-6929 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dynamic Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘dfiFeatured’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dynamic Featured Image
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Dynamic Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024Share This Image: Stored Cross-Site ScriptingCVE-2024-8363 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all versions up to, and including, 2.02 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Share This Image
Affected
up to 2.02
What to do
Affects up to 2.02. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2024WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature.CVE-2024-45270 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
Fixed in
2.2.4
What to do
Update the plugin to 2.2.4 or newer.
Full record and what to do →NVD record github.com jvn.jp
Sep 1, 2024WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature.CVE-2024-45269 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
Fixed in
2.0
What to do
Update the plugin to 2.0 or newer.
Full record and what to do →NVD record github.com jvn.jp
Aug 31, 2024Share This Image: Stored Cross-Site ScriptingCVE-2024-8108 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Share This Image
Affected
up to 2.01
What to do
Affects up to 2.01. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.