Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
737 results · page 9 of 15
Feb 18, 2025Actionwear products sync: Full Path DisclosureCVE-2024-13535 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-setup.php file being publicly accessible with 'display_errors' set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Actionwear products sync
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2025Easy Amazon Product Information: Cross-Site Request Forgery (CSRF)CVE-2025-26568 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue affects Easy Amazon Product Information: from n/a through <= 4.0.1.
- Product
- Easy Amazon Product Information
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Easy Amazon Product Information to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025Export All Posts, Products, Orders, Refunds & Users: Sensitive Information ExposureCVE-2024-12315 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.
- Product
- Export All Posts, Products, Orders, Refunds & Users
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2025Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands: Stored Cross-Site ScriptingCVE-2024-11746 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2025Product Blocks for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks-for-woocommerce allows Stored XSS.This issue affects Product Blocks for WooCommerce: from n/a through <= 1.9.1.
- Product
- Product Blocks for WooCommerce
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025The WooCommerce Product Table Lite: Arbitrary shortcode executionCVE-2024-13472 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'sc_attrs' parameter is vulnerable to Reflected Cross-Site Scripting as well.
- Product
- The WooCommerce Product Table Lite
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update The WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 31, 2025ECT Home Page Products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13225 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ECT Home Page Products
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update ECT Home Page Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2025-24603 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through <= 3.4.10.
- Product
- Print Barcode Labels for your WooCommerce products/orders
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 25, 2025Custom Product Tabs Lite for WooCommerce: PHP Object InjectionCVE-2024-12600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frs_woo_product_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Custom Product Tabs Lite for WooCommerce
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Custom Product Tabs Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2025Product Carousel Slider & Grid Ultimate for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.
- Product
- Product Carousel Slider & Grid Ultimate for WooCommerce
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Product Table Lite: Missing AuthorizationCVE-2025-24596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Product Size Charts Plugin for WooCommerce: Missing AuthorizationCVE-2025-23991 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through <= 2.4.5.
- Product
- Product Size Charts Plugin for WooCommerce
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Product Size Charts Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025Product Table by WBW: SQL InjectionCVE-2024-13234 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Product Table by WBW
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 21, 2025Fancy Product Designer: Unrestricted Upload of File with Dangerous TypeCVE-2024-51919 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.
- Product
- Fancy Product Designer
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Fancy Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51818 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.
- Product
- Fancy Product Designer
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Neon Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22799 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.
- Product
- Neon Product Designer
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Neon Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Product Carousel For WooCommerce – WoorouSell: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22724 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP Product Carousel For WooCommerce – WoorouSell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through 1.1.0.
- Product
- Product Carousel For WooCommerce – WoorouSell
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Product Carousel For WooCommerce – WoorouSell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Advanced Product Information for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through <= 1.1.4.
- Product
- Advanced Product Information for WooCommerce
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Advanced Product Information for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Product Table for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22307 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam Product Table for WooCommerce woo-product-table allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through <= 4.0.3.
- Product
- Product Table for WooCommerce
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Product Table for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Education LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7.
- Product
- Education LMS
- Affected
- up to 0.0.7
- What to do
- Affects up to 0.0.7. Update Education LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Opencart Product in WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22335 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through <= 1.0.1.
- Product
- Opencart Product in WP
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Opencart Product in WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22352 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
- Product
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ProductDyno: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProductDyno ProductDyno productdyno allows Reflected XSS.This issue affects ProductDyno: from n/a through <= 1.0.24.
- Product
- ProductDyno
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update ProductDyno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Compare Products for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-12435 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Compare Products for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s_feature’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Compare Products for WooCommerce
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Compare Products for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Compare Products for WooCommerce: PHP Object InjectionCVE-2024-12313 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Compare Products for WooCommerce
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Compare Products for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Custom Product Tabs for WooCommerce: PHP Object InjectionCVE-2024-11465 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikes_woo_products_tabs' post meta parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Custom Product Tabs for WooCommerce
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025Education Zone: Cross-Site Request Forgery (CSRF)CVE-2024-37103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Education Zone education-zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through <= 1.3.4.
- Product
- Education Zone
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Education Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025YITH WooCommerce Product Add-Ons: Missing AuthorizationCVE-2023-46635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.2.0.
- Product
- YITH WooCommerce Product Add-Ons
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Product Recommendation Quiz for eCommerce: Missing AuthorizationCVE-2023-46631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RevenueHunt Product Recommendation Quiz for eCommerce product-recommendation-quiz-for-ecommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Recommendation Quiz for eCommerce: from n/a through <= 2.1.2.
- Product
- Product Recommendation Quiz for eCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Recommendation Quiz for eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Smart Shopify Product: Missing AuthorizationCVE-2024-56031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through <= 1.0.2.
- Product
- Smart Shopify Product
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Smart Shopify Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Dynamic Product Category Grid, Slider for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56230 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Dynamic Product Category Grid, Slider for WooCommerce dynamic-product-categories-design allows PHP Local File Inclusion.This issue affects Dynamic Product Category Grid, Slider for WooCommerce: from n/a through <= 1.1.3.
- Product
- Dynamic Product Category Grid, Slider for WooCommerce
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Dynamic Product Category Grid, Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2024eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2024-12771 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- eCommerce Product Catalog Plugin for
- Affected
- up to 3.3.43
- What to do
- Affects up to 3.3.43. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 21, 2024Custom Product Tabs For WooCommerce: PHP Object InjectionCVE-2024-12721 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserialization of untrusted input from the 'wb_custom_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Custom Product Tabs For WooCommerce
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Custom Product Tabs For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
- Product
- Dreamfox Media Payment gateway per Product for Woocommerce
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Amazon Product Price: Cross-Site Request Forgery (CSRF)CVE-2024-54439 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.
- Product
- Amazon Product Price
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Amazon Product Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024ECT Product Carousel: Cross-Site Request Forgery (CSRF)CVE-2024-54412 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carousel: from n/a through <= 1.9.
- Product
- ECT Product Carousel
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update ECT Product Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024XPD Reduce Image Filesize: Cross-Site Request Forgery (CSRF)CVE-2024-54409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fzmaster XPD Reduce Image Filesize xpd-reduce-image-filesize allows Stored XSS.This issue affects XPD Reduce Image Filesize: from n/a through <= 1.0.
- Product
- XPD Reduce Image Filesize
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update XPD Reduce Image Filesize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024Posts and Products Views for WooCommerce: Stored Cross-Site ScriptingCVE-2024-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Posts and Products Views for WooCommerce
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Posts and Products Views for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 13, 2024Ni WooCommerce Bulk Product Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.
- Product
- Ni WooCommerce Bulk Product Editor
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Ni WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ovic Product Bundle: Missing AuthorizationCVE-2023-41649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ovic Team Ovic Product Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovic Product Bundle: from n/a through 1.1.2.
- Product
- Ovic Product Bundle
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ovic Product Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WooCommerce Product Stock Alert: Missing AuthorizationCVE-2023-37971 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024SW Product Bundles: Missing AuthorizationCVE-2023-36519 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.
- Product
- SW Product Bundles
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update SW Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Unauthorized accessCVE-2024-12172 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
- Product
- WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
- Affected
- up to 3.2.21
- What to do
- Affects up to 3.2.21. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Product Carousel Slider & Grid Ultimate for WooCommerce: Local File InclusionCVE-2024-12040 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Product Carousel Slider & Grid Ultimate for WooCommerce
- Affected
- up to 1.9.10
- What to do
- Affects up to 1.9.10. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 10, 2024The Active Products Tables for WooCommerce. Use constructor to create tables: Arbitrary shortcode executionCVE-2024-10959 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_get_smth AJAX action in all versions up to, and including, 1.0.6.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Active Products Tables for WooCommerce. Use constructor to create tables
- Affected
- up to 1.0.6.5
- What to do
- Affects up to 1.0.6.5. Update The Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2023-50899 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.2.
- Product
- Product Catalog Enquiry for WooCommerce by MultiVendorX
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Filter by WBW: Missing AuthorizationCVE-2023-50877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0.
- Product
- Product Filter by WBW
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stamped.io Product Reviews & UGC for WooCommerce: Missing AuthorizationCVE-2023-30479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.3.2.
- Product
- Stamped.io Product Reviews & UGC for WooCommerce
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Stamped.io Product Reviews & UGC for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Category Tree: Missing AuthorizationCVE-2023-29173 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.
- Product
- Product Category Tree
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Product Category Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Unauthorized accessCVE-2024-12253 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
- Product
- Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.