Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

51 results · page 1 of 2

Oct 10, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Insecure Direct Object ReferenceCVE-2026-93746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026Dashboard Notes: Cross-Site Request Forgery (CSRF)CVE-2026-62026 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.
Product
Dashboard Notes
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Dashboard Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Directory TraversalCVE-2026-18027 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.CVE-2026-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.CVE-2026-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2026jQuery Hover Footnotes: Stored Cross-Site ScriptingCVE-2026-10738 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts.
Product
jQuery Hover Footnotes
Affected
up to 1.4
What to do
Affects up to 1.4. Update jQuery Hover Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2026jQuery Hover Footnotes: Cross-Site Request ForgeryCVE-2026-10553 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the jqFootnotes_options_subpanel function. This makes it possible for unauthenticated attackers to update the plugin's settings with arbitrary values that, because option values such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title are echoed unescaped into frontend page content, can be chained into persistent Cross-Site Scripting affecting all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation of the CSRF vulnerability can be chained into stored Cross-Site Scripting, as the overwritten option values are persisted via update_option() without sanitization and rendered unescaped on the frontend.
Product
jQuery Hover Footnotes
Affected
up to 1.4
What to do
Affects up to 1.4. Update jQuery Hover Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Frontend User Notes: Cross-Site Request ForgeryCVE-2026-7047 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged cross-site request to wp_update_post() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to ownership enforcement comparing the note's stored _funp_single_user_id meta against the current session's user ID, the attack is limited to modifying only notes belonging to the tricked victim, and cannot be used to alter notes owned by arbitrary third-party users.
Product
Frontend User Notes
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Frontend User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-25317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-24946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2026Frontend User Notes: Insecure Direct Object ReferenceCVE-2025-12071 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_modify_notes' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary notes that do not belong to them.
Product
Frontend User Notes
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Frontend User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2026AJS Footnotes: Stored Cross-Site ScriptingCVE-2025-15378 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all versions up to, and including, 1.0 due to missing authorization and nonce verification on settings save, as well as insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to update plugin settings and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AJS Footnotes
Affected
up to 1.0
What to do
Affects up to 1.0. Update AJS Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 31, 2025Sticky Notes for WP Dashboard: Missing AuthorizationCVE-2025-62087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
Product
Sticky Notes for WP Dashboard
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Sticky Notes for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Print Invoice & Delivery Notes for WooCommerce: Remote Code ExecutionCVE-2025-13773 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025Page & Post Notes: Unauthorized modification of notesCVE-2025-12527 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.
Product
Page & Post Notes
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Page & Post Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025Footnotes Made Easy: Stored Cross-Site ScriptingCVE-2025-11733 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Footnotes Made Easy
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Footnotes Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025User Notes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60136 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through <= 1.0.2.
Product
User Notes
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Modern Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows Stored XSS.This issue affects Modern Footnotes: from n/a through <= 1.4.19.
Product
Modern Footnotes
Affected
up to 1.4.19
What to do
Affects up to 1.4.19. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Admin Notes: Cross-Site Request Forgery (CSRF)CVE-2025-49446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through <= 1.1.
Product
Admin Notes
Affected
up to 1.1
What to do
Affects up to 1.1. Update Admin Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Print Invoice & Delivery Notes for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-49239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Product Notes Tab & Private Admin Notes for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48239 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for WooCommerce product-notes-for-woocommerce allows Stored XSS.This issue affects Product Notes Tab & Private Admin Notes for WooCommerce: from n/a through <= 3.1.0.
Product
Product Notes Tab & Private Admin Notes for WooCommerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Product Notes Tab & Private Admin Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025WP Notes Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48121 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget wp-notes-widget allows DOM-Based XSS.This issue affects WP Notes Widget: from n/a through <= 1.0.6.
Product
WP Notes Widget
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WP Notes Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025WP Dashboard Notes: Does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX actionCVE-2023-7239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
Product
WP Dashboard Notes
Fixed in
1.0.11
What to do
Update WP Dashboard Notes to 1.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Apr 1, 2025Footnotes for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31735 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in C. Johnson Footnotes for WordPress footnotes-for-wordpress allows Stored XSS.This issue affects Footnotes for WordPress: from n/a through <= 2016.1230.
Product
Footnotes for
Affected
up to 2016.1230
What to do
Affects up to 2016.1230. Update Footnotes for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 8, 2025Print Invoice & Delivery Notes for WooCommerce: Sensitive Information ExposureCVE-2024-13640 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24644 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Post & Page Notes: Cross-Site Request Forgery (CSRF)CVE-2025-23715 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in RaymondDesign Post & Page Notes post-page-notes allows Stored XSS.This issue affects Post & Page Notes: from n/a through <= 0.1.1.
Product
Post & Page Notes
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Post & Page Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Inline Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.
Product
Inline Footnotes
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Inline Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Print Invoice & Delivery Notes for WooCommerce: Unauthorized modification of dataCVE-2024-12210 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdn_remove_shoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.0
What to do
Affects up to 5.4.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2022-46795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2024WPC Order Notes for WooCommerce: Cross-Site Request ForgeryCVE-2024-12004 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajax_update_order_note() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WPC Order Notes for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update WPC Order Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024WPDash Notes: Unauthorized access of dataCVE-2024-9223 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPDash Notes plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_ajax_post_it_list_comment' function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view comments on any post, including private and password protected posts, and pending and draft posts if they were previously published. The vulnerability was partially patched in version 1.3.5.
Product
WPDash Notes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update WPDash Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2024Plugin Notes Plus: Missing AuthorizationCVE-2024-43326 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.
Product
Plugin Notes Plus
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Plugin Notes Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024WP Dashboard Notes: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43226 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XSS.This issue affects WP Dashboard Notes: from n/a through 1.0.11.
Product
WP Dashboard Notes
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update WP Dashboard Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 20, 2024Simple Post Notes: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37562 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BracketSpace Simple Post Notes allows Stored XSS.This issue affects Simple Post Notes: from n/a through 1.7.7.
Product
Simple Post Notes
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Simple Post Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Plugin Notes Plus: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37561 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jamie Bergen Plugin Notes Plus allows Stored XSS.This issue affects Plugin Notes Plus: from n/a through 1.2.6.
Product
Plugin Notes Plus
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Plugin Notes Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Privilege ManagementCVE-2023-51546 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2024-4233 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Simple Post Notes: Cross-Site Request Forgery (CSRF)CVE-2024-31935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in BracketSpace Simple Post Notes.This issue affects Simple Post Notes: from n/a through 1.7.6.
Product
Simple Post Notes
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Simple Post Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized modification of dataCVE-2024-3216 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22288 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Reflected XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.4.0.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Stored Cross-Site ScriptingCVE-2024-0957 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024WP Dashboard Notes: Is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameterCVE-2023-7198 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.
Product
WP Dashboard Notes
Fixed in
1.0.11
What to do
Update WP Dashboard Notes to 1.0.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Site Notes: Does not have CSRF checks in some of its functionalitiesCVE-2023-6633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
Product
Site Notes
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Site Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Print Invoice & Delivery Notes for WooCommerce: Is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders pageCVE-2023-0479 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.
Product
Print Invoice & Delivery Notes for WooCommerce
Fixed in
4.7.2
What to do
Update Print Invoice & Delivery Notes for WooCommerce to 4.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized access of dataCVE-2023-7068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Modern Footnotes: Stored Cross-Site ScriptingCVE-2023-5618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Modern Footnotes
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jul 17, 2022Simple Post Notes: Does not sanitise and escape its settingsCVE-2022-2186 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Simple Post Notes
Fixed in
1.7.6
What to do
Update Simple Post Notes to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Shield Security: Does not sanitise and escape admin notesCVE-2022-0211 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Shield Security
Fixed in
13.0.6
What to do
Update Shield Security to 13.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Product
Support Board
Fixed in
3.3.5
What to do
Update Support Board to 3.3.5 or newer.
Full record and what to do →NVD record github.com medium.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.