Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

545new WordPress flaws this week

391,964entries in the database

6,273 results · page 106 of 126

May 17, 2024Editorialmag: Missing AuthorizationCVE-2023-32129 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle WP Editorialmag editorialmag.This issue affects Editorialmag: from n/a through 1.1.9.
Product
Editorialmag
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Editorialmag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024My Tickets: Missing AuthorizationCVE-2023-23988 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Joseph C Dolson My Tickets.This issue affects My Tickets: from n/a through 1.9.11.
Product
My Tickets
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Conditional Checkout Fields for WooCommerce: Missing AuthorizationCVE-2022-45070 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3.
Product
Conditional Checkout Fields for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Conditional Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024ReviewX – Multi-criteria Rating & Reviews for WooCommerce: Unauthorized deletion of dataCVE-2024-3609 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments.
Product
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Affected
up to 1.6.27
What to do
Affects up to 1.6.27. Update ReviewX – Multi-criteria Rating & Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2024Tutor LMS Pro: Unauthorized access of data, modification of data, loss of dataCVE-2024-4352 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'get_calendar_materials' function. The plugin is also vulnerable to SQL Injection via the ‘year’ parameter of that function due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tutor LMS Pro
Fixed in
2.7.1
What to do
Update Tutor LMS Pro to 2.7.1 or newer.
Full record and what to do →NVD record themeum.com wordfence.com
May 16, 2024Tutor LMS Pro: Unauthorized access of data, modification of data, loss of dataCVE-2024-4351 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.
Product
Tutor LMS Pro
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeum.com wordfence.com
May 16, 2024Tutor LMS Pro: Unauthorized access of data, modification of data, loss of dataCVE-2024-4222 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.
Product
Tutor LMS Pro
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeum.com wordfence.com
May 16, 2024Tutor LMS: Unauthorized access of data, modification of data, loss of dataCVE-2024-4223 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
Product
Tutor LMS
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2024Visualizer: Tables and Charts Manager for: Unauthorized modification and retrieval of dataCVE-2024-3750 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queries that can be leveraged for privilege escalation among many other actions.
Product
Visualizer: Tables and Charts Manager for
Affected
up to 3.10.15
What to do
Affects up to 3.10.15. Update Visualizer: Tables and Charts Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2024Email Subscribers by Icegram Express: Unauthorized access of data, modification of data, and loss of dataCVE-2024-4010 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handle_ajax_request function in all versions up to, and including, 5.7.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to cause a loss of confidentiality, integrity, and availability, by performing multiple unauthorized actions. Some of these actions could also be leveraged to conduct PHP Object Injection and SQL Injection attacks.
Product
Email Subscribers by Icegram Express
Affected
up to 5.7.19
What to do
Affects up to 5.7.19. Update Email Subscribers by Icegram Express to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Bulk Posts Editing For: Unauthorized access of functionalityCVE-2024-4199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplication, post content retrieval, post taxonomy manipulation.
Product
Bulk Posts Editing For
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update Bulk Posts Editing For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024WP Compress – Image Optimizer [All-In-One]: Unauthorized modification of dataCVE-2024-4445 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.
Product
WP Compress – Image Optimizer [All-In-One]
Affected
up to 6.20.01
What to do
Affects up to 6.20.01. Update WP Compress – Image Optimizer [All-In-One] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024YITH WooCommerce Gift Cards: Unauthorized modification of dataCVE-2024-0870 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings.
Product
YITH WooCommerce Gift Cards
Affected
up to 4.12.0
What to do
Affects up to 4.12.0. Update YITH WooCommerce Gift Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024White Label CMS: Unauthorized modification of dataCVE-2024-4280 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings.
Product
White Label CMS
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update White Label CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Swift Framework: Unauthorized modification of dataCVE-2024-3915 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sf_edit_directory_item() function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary posts with arbitrary content. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details.
Product
Swift Framework
Affected
up to 2.7.31
What to do
Affects up to 2.7.31. Update Swift Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record swiftideas.com wordfence.com
May 14, 2024Swift Performance Lite: Unauthorized accessCVE-2024-3722 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve and modify settings.
Product
Swift Performance Lite
Affected
up to 2.3.6.18
What to do
Affects up to 2.3.6.18. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Academy LMS: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35171 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.25.
Product
Academy LMS
Affected
up to 1.9.25
What to do
Affects up to 1.9.25. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Filebird: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35166 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3.
Product
Filebird
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Gutenify: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35165 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gutenify.This issue affects Gutenify: from n/a through 1.4.0.
Product
Gutenify
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Gutenify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP Job Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34549 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.2.2.
Product
WP Job Manager
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Custom WooCommerce Checkout Fields Editor: Missing AuthorizationCVE-2024-33956 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
Product
Custom WooCommerce Checkout Fields Editor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Google Typography: Missing AuthorizationCVE-2024-33942 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Eric Alli Google Typography.This issue affects Google Typography: from n/a through 1.1.2.
Product
Google Typography
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Google Typography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sliding Widgets: Missing AuthorizationCVE-2024-33938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codename065 Sliding Widgets allows Cross-Site Scripting (XSS).This issue affects Sliding Widgets: from n/a through 1.5.0.
Product
Sliding Widgets
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Sliding Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024AppPresser: Missing AuthorizationCVE-2024-32776 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0.
Product
AppPresser
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2024-32724 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Woo product importer Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1.
Product
Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP Club Manager: Missing AuthorizationCVE-2024-32719 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Club Manager WP Club Manager wp-club-manager.This issue affects WP Club Manager: from n/a through <= 2.2.11.
Product
WP Club Manager
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update WP Club Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SchedulePress: Missing AuthorizationCVE-2024-32717 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through 5.0.8.
Product
SchedulePress
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update SchedulePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Podlove Podcast Publisher: Missing AuthorizationCVE-2024-32712 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.
Product
Podlove Podcast Publisher
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Easy Digital Downloads: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32100 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.
Product
Easy Digital Downloads
Affected
up to 3.2.11
What to do
Affects up to 3.2.11. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SP Project & Document Manager: Unauthorized modification of dataCVE-2024-1693 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.
Product
SP Project & Document Manager
Affected
up to 4.70
What to do
Affects up to 4.70. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024SimpleShop: Unauthorized disconnection from SimpleShopCVE-2024-1229 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SimpleShop plugin for WordPress is vulnerable to unauthorized disconnection from SimpleShop due to a missing capability check on the maybe_disconnect_simpleshop function in all versions up to, and including, 2.10.2. This makes it possible for unauthenticated attackers to disconnect the SimpleShop.
Product
SimpleShop
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update SimpleShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024ShopLentor (formerly WooLentor): Unauthorized access of dataCVE-2023-6327 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purchased them.
Product
ShopLentor (formerly WooLentor)
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update ShopLentor (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2024-4233 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Vitepos: Missing AuthorizationCVE-2024-33574 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
Product
Vitepos
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024EPROLO Dropshipping: Missing AuthorizationCVE-2024-33573 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1.
Product
EPROLO Dropshipping
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update EPROLO Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024ARForms Form Builder: Missing AuthorizationCVE-2024-31270 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.
Product
ARForms Form Builder
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024AI WP Writer: Missing AuthorizationCVE-2024-30459 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5.
Product
AI WP Writer
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update AI WP Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Happy Addons for Elementor: Missing AuthorizationCVE-2024-24833 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.1.
Product
Happy Addons for Elementor
Affected
up to 3.10.1
What to do
Affects up to 3.10.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Rolo Slider: Missing AuthorizationCVE-2024-1438 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9.
Product
Rolo Slider
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Rolo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-40218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
Product
Advance WordPress Search
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Multi-column Tag Map: Missing AuthorizationCVE-2023-41651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26.
Product
Multi-column Tag Map
Affected
up to 17.0.26
What to do
Affects up to 17.0.26. Update Multi-column Tag Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 7, 2024Tilda Publishing: Missing AuthorizationCVE-2023-31234 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Tilda Publishing.This issue affects Tilda Publishing: from n/a through 0.3.23.
Product
Tilda Publishing
Affected
up to 0.3.23
What to do
Affects up to 0.3.23. Update Tilda Publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 7, 2024ClickCease Click Fraud Protection: Unauthorized access of dataCVE-2023-6810 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check on the get_settings function in all versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with author access and above, to retrieve the plugin's configured API keys.
Product
ClickCease Click Fraud Protection
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update ClickCease Click Fraud Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2024WidgetKit: Missing AuthorizationCVE-2024-33908 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.
Product
WidgetKit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Print My Blog: Missing AuthorizationCVE-2024-33907 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2.
Product
Print My Blog
Affected
up to 3.26.2
What to do
Affects up to 3.26.2. Update Print My Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WPPizza: Missing AuthorizationCVE-2024-33576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.
Product
WPPizza
Affected
up to 3.18.10
What to do
Affects up to 3.18.10. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Metform: Missing AuthorizationCVE-2024-33570 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3.
Product
Metform
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WP Post Author: Missing AuthorizationCVE-2024-34389 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
Product
WP Post Author
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WP Post Author: Missing AuthorizationCVE-2024-34387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
Product
WP Post Author
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024LeadConnector: Missing AuthorizationCVE-2024-34378 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7.
Product
LeadConnector
Affected
up to 1.7
What to do
Affects up to 1.7. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.