Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

6,273 results · page 104 of 126

Jun 9, 2024MainWP UpdraftPlus Extension: Missing AuthorizationCVE-2023-23640 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.
Product
MainWP UpdraftPlus Extension
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update MainWP UpdraftPlus Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024MainWP Staging Extension: Missing AuthorizationCVE-2023-23639 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3.
Product
MainWP Staging Extension
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update MainWP Staging Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WP Sort Order: Missing AuthorizationCVE-2024-31294 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fahad Mahmood WP Sort Order.This issue affects WP Sort Order: from n/a through 1.3.1.
Product
WP Sort Order
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP Sort Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024PostX: Missing AuthorizationCVE-2024-31246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.
Product
PostX
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024New Order Notification for Woocommerce: Missing AuthorizationCVE-2024-31098 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Mr.Ebabi New Order Notification for Woocommerce.This issue affects New Order Notification for Woocommerce: from n/a through 2.0.2.
Product
New Order Notification for Woocommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update New Order Notification for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Awesome Support: Missing AuthorizationCVE-2024-30539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
Product
Awesome Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024DELUCKS SEO: Missing AuthorizationCVE-2024-30538 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS GmbH DELUCKS SEO.This issue affects DELUCKS SEO: from n/a through 2.5.4.
Product
DELUCKS SEO
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WPC Badge Management for WooCommerce: Missing AuthorizationCVE-2024-30537 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.
Product
WPC Badge Management for WooCommerce
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update WPC Badge Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Calendarista Basic Edition: Missing AuthorizationCVE-2024-30534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.
Product
Calendarista Basic Edition
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Booster Plus for WooCommerce: Missing AuthorizationCVE-2023-52232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Product
Booster Plus for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Plus for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Booster Plus for WooCommerce: Missing AuthorizationCVE-2023-52230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.
Product
Booster Plus for WooCommerce
Fixed in
7.1.3
What to do
Update Booster Plus for WooCommerce to 7.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WooCommerce Product Vendors: Missing AuthorizationCVE-2023-51494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.
Product
WooCommerce Product Vendors
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WooCommerce Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Import and export users and customers: Missing AuthorizationCVE-2024-22151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
Product
Import and export users and customers
Affected
up to 1.24.6
What to do
Affects up to 1.24.6. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Icegram: Missing AuthorizationCVE-2024-21748 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.
Product
Icegram
Affected
up to 3.1.21
What to do
Affects up to 3.1.21. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024KiviCare: Missing AuthorizationCVE-2024-35659 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.
Product
KiviCare
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Widget Options - Extended: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35691 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.
Product
Widget Options - Extended
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Widget Options - Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Otter Blocks PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.
Product
Otter Blocks PRO
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Otter Blocks PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Podlove Web Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35710 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3.
Product
Podlove Web Player
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024CF7 Google Sheets Connector: Unauthorized modification of dataCVE-2024-5654 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.
Product
CF7 Google Sheets Connector
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 8, 2024Salon booking system: Unauthorized access and modification of dataCVE-2024-4468 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.
Product
Salon booking system
Affected
up to 9.9
What to do
Affects up to 9.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 8, 2024Minimal Coming Soon – Coming Soon Page: Unauthorized modification of dataCVE-2024-5087 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.
Product
Minimal Coming Soon – Coming Soon Page
Affected
up to 2.38
What to do
Affects up to 2.38. Update Minimal Coming Soon – Coming Soon Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 8, 2024WP Reset: Unauthorized modification of dataCVE-2024-4661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.
Product
WP Reset
Affected
up to 2.02
What to do
Affects up to 2.02. Update WP Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 8, 2024WP Force SSL & HTTPS SSL Redirect: Unauthorized modification of dataCVE-2024-5770 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
Product
WP Force SSL & HTTPS SSL Redirect
Affected
up to 1.66
What to do
Affects up to 1.66. Update WP Force SSL & HTTPS SSL Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Unauthorized modification of dataCVE-2024-5382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
Product
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Affected
up to 2.0.6.1
What to do
Affects up to 2.0.6.1. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2024Market Exporter: Unauthorized loss of dataCVE-2024-5637 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server.
Product
Market Exporter
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Strong Testimonials: Unauthorized modification of dataCVE-2023-6491 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.
Product
Strong Testimonials
Affected
up to 3.1.12
What to do
Affects up to 3.1.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024GDPR CCPA Compliance & Cookie Consent Banner: Unauthorized modification of dataCVE-2024-5607 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts.
Product
GDPR CCPA Compliance & Cookie Consent Banner
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update GDPR CCPA Compliance & Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024WooCommerce Tools: Unauthorized modification of dataCVE-2024-1689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.
Product
WooCommerce Tools
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WooCommerce Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Clever Fox – One Click Website Importer by Nayra: Unauthorized modification of dataCVE-2023-6876 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site.
Product
Clever Fox – One Click Website Importer by Nayra
Affected
up to 25.2.0
What to do
Affects up to 25.2.0. Update Clever Fox – One Click Website Importer by Nayra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Wbcom Designs – Custom Font Uploader: Unauthorized loss of dataCVE-2024-5489 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfu_delete_customfont' function in all versions up to, and including, 2.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete any custom font.
Product
Wbcom Designs – Custom Font Uploader
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Wbcom Designs – Custom Font Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Login/Signup Popup ( Inline Form + Woocommerce ): Unauthorized access of dataCVE-2024-5665 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites.
Product
Login/Signup Popup ( Inline Form + Woocommerce )
Affected
2.7.1 to 2.7.2
What to do
Affects 2.7.1 to 2.7.2. Update Login/Signup Popup ( Inline Form + Woocommerce ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing: Unauthorized modification of dataCVE-2024-5449 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024WP-Recall – Registration, Profile, Commerce & More: Unauthorized loss of dataCVE-2024-1175 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_payment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete arbitrary payments.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.6
What to do
Affects up to 16.26.6. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 5, 2024Countdown, Coming Soon, Maintenance – Countdown & Clock: Unauthorized accessCVE-2024-2017 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns.
Product
Countdown, Coming Soon, Maintenance – Countdown & Clock
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Countdown, Coming Soon, Maintenance – Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'impoCVE-2024-5324 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Boostify Header Footer Builder for Elementor: Unauthorized modification of dataCVE-2024-4788 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content.
Product
Boostify Header Footer Builder for Elementor
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Boostify Header Footer Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024The Moneytizer: Unauthorized access of data, modification of data, and loss of dataCVE-2023-6966 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.
Product
The Moneytizer
Affected
up to 9.6.3
What to do
Affects up to 9.6.3. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2024-35674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.109.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.109
What to do
Affects up to 1.5.109. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024Restaurant Menu and Food Ordering: Unauthorized creation of dataCVE-2024-5459 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', 'add_menu', 'add_menu_item', and 'add_menu_page' functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, menus, food items, and new menu pages.
Product
Restaurant Menu and Food Ordering
Affected
up to 2.4.16
What to do
Affects up to 2.4.16. Update Restaurant Menu and Food Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024ProfileGrid – User Profiles, Groups and Communities: Unauthorized modification of dataCVE-2024-5453 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.8.6
What to do
Affects up to 5.8.6. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Gutenberg Blocks and Page Layouts – Attire Blocks: Unauthorized modification of dataCVE-2024-4088 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable_fe_assets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with subscriber access or above, to change the plugin's settings. Additionally, no nonce check is performed resulting in a CSRF vulnerability.
Product
Gutenberg Blocks and Page Layouts – Attire Blocks
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Gutenberg Blocks and Page Layouts – Attire Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024Spiffy Calendar: Missing AuthorizationCVE-2024-30528 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
Product
Spiffy Calendar
Affected
up to 4.9.10
What to do
Affects up to 4.9.10. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Move Addons for Elementor: Missing AuthorizationCVE-2024-30525 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9.
Product
Move Addons for Elementor
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Netgsm: Missing AuthorizationCVE-2024-35672 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.19.
Product
Netgsm
Affected
up to 2.9.19
What to do
Affects up to 2.9.19. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024RT Easy Builder – Advanced addons for Elementor: Missing AuthorizationCVE-2024-30484 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RT Easy Builder – Advanced addons for Elementor.This issue affects RT Easy Builder – Advanced addons for Elementor: from n/a through 2.0.
Product
RT Easy Builder – Advanced addons for Elementor
Affected
up to 2.0
What to do
Affects up to 2.0. Update RT Easy Builder – Advanced addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024All In One WP Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52147 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
Product
All In One WP Security & Firewall
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update All In One WP Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Ultimate Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49822 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10.
Product
Ultimate Dashboard
Affected
up to 3.7.10
What to do
Affects up to 3.7.10. Update Ultimate Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Photo Album Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49774 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
Product
WP Photo Album Plus
Affected
up to 8.5.02.005
What to do
Affects up to 8.5.02.005. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WPS Hide Login: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49748 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.
Product
WPS Hide Login
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Hide login page: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48335 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.
Product
Hide login page
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hide login page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.