Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

570 results · page 10 of 12

Apr 24, 2024BuddyBoss: Improper AuthenticationCVE-2023-51477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyBoss Theme: from n/a through 2.4.60.
Product
BuddyBoss
Affected
up to 2.4.60
What to do
Affects up to 2.4.60. Update BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Checkout Mestres WP: Improper AuthenticationCVE-2023-51472 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through 7.1.9.7.
Product
Checkout Mestres WP
Affected
up to 7.1.9.7
What to do
Affects up to 7.1.9.7. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Checkout Mestres WP: Improper AuthenticationCVE-2023-51471 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Checkout Mestres WP: from n/a through 7.1.9.7.
Product
Checkout Mestres WP
Affected
up to 7.1.9.7
What to do
Affects up to 7.1.9.7. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024BookingPress: Improper AuthenticationCVE-2023-51405 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BookingPress: from n/a through 1.0.74.
Product
BookingPress
Affected
up to 1.0.74
What to do
Affects up to 1.0.74. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Elementor Website Builder: Improper AuthenticationCVE-2023-47504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elementor Website Builder: from n/a through 3.16.4.
Product
Elementor Website Builder
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WoodMart: Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-25790 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.
Product
WoodMart
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024WP 2FA: Improper AuthenticationCVE-2022-44595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
Product
WP 2FA
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WP 2FA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Web3: Is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'CVE-2023-6036 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
Web3
Fixed in
3.0.0
What to do
Update Web3 to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication.CVE-2024-0212 · WordPress plugins & themes · reported by cna@cloudflare.comHigh 8.1
The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.
Fixed in
4.12.3
What to do
Update the plugin to 4.12.3 or newer.
Full record and what to do →NVD record github.com github.com
Jan 22, 2024EventPrime: Lacks authentication and authorizationCVE-2023-6447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.
Product
EventPrime
Fixed in
3.3.6
What to do
Update EventPrime to 3.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024WP 2FA – Two-factor authentication for: Cross-Site Request ForgeryCVE-2023-6520 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.
Product
WP 2FA – Two-factor authentication for
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP 2FA – Two-factor authentication for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024WP 2FA – Two-factor authentication for: Insecure Direct Object ReferenceCVE-2023-6506 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.
Product
WP 2FA – Two-factor authentication for
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP 2FA – Two-factor authentication for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 1, 2024affiliate-toolkit: Lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiverCVE-2023-5877 · WordPress plugins & themes · reported by WPScanCritical 9.8
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
Product
affiliate-toolkit
Fixed in
3.4.3
What to do
Update affiliate-toolkit to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
Product
Solid Security – Password, Two Factor Authentication, and Brute Force Protection
Affected
up to 8.1.4
What to do
Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication –CVE-2022-44589 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Password Reset with Code for WordPress REST API: Improper Restriction of Excessive Authentication AttemptsCVE-2023-35039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
Product
Password Reset with Code for WordPress REST API
Affected
up to 0.0.15
What to do
Affects up to 0.0.15. Update Password Reset with Code for WordPress REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023UserPro: Authentication bypassCVE-2023-2437 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user's email address to successfully exploit this vulnerability.
Product
UserPro
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 31, 2023Stripe Payment Plugin for WooCommerce: Authentication bypassCVE-2023-3162 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically customers.
Product
Stripe Payment Plugin for WooCommerce
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Stripe Payment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 18, 2023OAuth Single Sign On – SSO (OAuth Client): Improper AuthenticationCVE-2022-34155 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.23.3
What to do
Affects up to 6.23.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Jul 10, 2023EventON: Lacks authentication and authorization in its eventon_ics_download ajax actionCVE-2023-2796 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
Product
EventON
Fixed in
2.1.2
What to do
Update EventON to 2.1.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 29, 2023Web3 – Crypto wallet Login & NFT token gating: Authentication bypassCVE-2023-3249 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
Web3 – Crypto wallet Login & NFT token gating
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Web3 – Crypto wallet Login & NFT token gating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 29, 2023BookIt: Authentication bypassCVE-2023-2834 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
BookIt
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update BookIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 28, 2023WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Authentication bypassCVE-2023-2982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Product
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
Affected
up to 7.6.4
What to do
Affects up to 7.6.4. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 7, 2023Abandoned Cart Lite for WooCommerce: Authentication bypassCVE-2023-2986 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Product
Abandoned Cart Lite for WooCommerce
Affected
up to 5.14.2
What to do
Affects up to 5.14.2. Update Abandoned Cart Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 6, 2023Wordable: Authentication bypassCVE-2020-36724 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges.
Product
Wordable
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Wordable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023MStore API: Authentication bypassCVE-2020-36713 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.
Product
MStore API
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com acunetix.com
Jun 5, 2023WP User Switch: Authentication bypassCVE-2023-2546 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
WP User Switch
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP User Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 2, 2023User Email Verification for WooCommerce: Authentication bypassCVE-2023-2781 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default.
Product
User Email Verification for WooCommerce
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update User Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2023MStore API: Authentication bypassCVE-2023-2734 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Product
MStore API
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2023MStore API: Authentication bypassCVE-2023-2733 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Product
MStore API
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2023MStore API: Authentication bypassCVE-2023-2732 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Product
MStore API
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2023BP Social Connect: Authentication bypassCVE-2023-2704 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
BP Social Connect
Affected
up to 1.5
What to do
Affects up to 1.5. Update BP Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
May 16, 2023OTP Login Woocommerce & Gravity Forms: Authentication bypassCVE-2023-2706 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
Product
OTP Login Woocommerce & Gravity Forms
Fixed in
2.3
What to do
Update OTP Login Woocommerce & Gravity Forms to 2.3 or newer.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
May 16, 2023RegistrationMagic: Authentication bypassCVE-2023-2499 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
RegistrationMagic
Affected
up to 5.2.1.0
What to do
Affects up to 5.2.1.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2023Essential Addons for Elementor: Improper AuthenticationCVE-2023-32243 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.
Product
Essential Addons for Elementor
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com patchstack.com
May 2, 2023Easy Digital Downloads: Improper AuthenticationCVE-2023-30869 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.
Product
Easy Digital Downloads
Affected
up to 3.1.1.4.1
What to do
Affects up to 3.1.1.4.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2023ZM Ajax Login & Register: Authentication bypassCVE-2023-2027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
ZM Ajax Login & Register
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ZM Ajax Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2023WP OAuth Server (OAuth Authentication): Has a flawed CSRF and authorisation checkCVE-2022-4148 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.
Product
WP OAuth Server (OAuth Authentication)
Fixed in
4.3.0
What to do
Update WP OAuth Server (OAuth Authentication) to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.
Product
WP OAuth Server (OAuth Authentication)
Fixed in
4.2.5
What to do
Update WP OAuth Server (OAuth Authentication) to 4.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3926 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
Product
WP OAuth Server (OAuth Authentication)
Fixed in
3.4.2
What to do
Update WP OAuth Server (OAuth Authentication) to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not sanitize and escape Client IDsCVE-2022-3892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP OAuth Server (OAuth Authentication)
Fixed in
4.2.2
What to do
Update WP OAuth Server (OAuth Authentication) to 4.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2022WordPress versions prior to 6.0.3: Improper authenticationCVE-2022-43504 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
Product
WordPress versions prior to 6.0.3
What to do
Update WordPress versions prior to 6.0.3 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.CVE-2022-45073 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 23, 2022Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.CVE-2022-35726 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.
Affected
up to 1.3.4.5
What to do
Affects up to 1.3.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 22, 2022Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.CVE-2022-34858 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.
Affected
up to 1.11.3
What to do
Affects up to 1.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Aug 22, 2022Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.CVE-2022-34149 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Aug 5, 2022JumpDEMAND Inc: Broken AuthenticationCVE-2022-36296 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/delete.
Product
JumpDEMAND Inc
Affected
up to 0.2.27
What to do
Affects up to 0.2.27. Update JumpDEMAND Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2022Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.CVE-2022-34839 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 9, 2022Popup by Supsystic: Does not have any authentication and authorisation in an AJAX actionCVE-2022-0424 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
Product
Popup by Supsystic
Fixed in
1.10.9
What to do
Update Popup by Supsystic to 1.10.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Tatsu: Add_custom_font action can be used without prior authentication to upload a rogue zip fileCVE-2021-25094 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
Product
Tatsu
Fixed in
3.3.12
What to do
Update Tatsu to 3.3.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com darkpills.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.