Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

545new WordPress flaws this week

391,964entries in the database

6,273 results · page 107 of 126

May 6, 2024Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: Missing AuthorizationCVE-2024-34377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
Product
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Post Grid Master: Missing AuthorizationCVE-2024-34372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.
Product
Post Grid Master
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Login with phone number: Missing AuthorizationCVE-2024-34371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.18.
Product
Login with phone number
Affected
up to 1.7.18
What to do
Affects up to 1.7.18. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Mooberry Book Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12.
Product
Mooberry Book Manager
Affected
up to 4.15.12
What to do
Affects up to 4.15.12. Update Mooberry Book Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Academy LMS: Missing AuthorizationCVE-2024-33912 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.
Product
Academy LMS
Affected
up to 1.9.16
What to do
Affects up to 1.9.16. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Digital Publications by Supsystic: Missing AuthorizationCVE-2024-33910 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.
Product
Digital Publications by Supsystic
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Digital Publications by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024GDPR Compliance: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34388 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
Product
GDPR Compliance
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024SEOPress: Authorization Bypass Through User-Controlled KeyCVE-2024-34383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.
Product
SEOPress
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Robo Gallery: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18.
Product
Robo Gallery
Affected
up to 3.2.18
What to do
Affects up to 3.2.18. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 4, 2024Import and export users and customers: Unauthorized modification of dataCVE-2024-1050 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
Product
Import and export users and customers
Affected
up to 1.26.5
What to do
Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 4, 2024ConvertPlug: Unauthorized modification of dataCVE-2024-3237 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to, and including, 3.5.25. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to true.
Product
ConvertPlug
Affected
up to 3.5.25
What to do
Affects up to 3.5.25. Update ConvertPlug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record convertplug.com wordfence.com
May 3, 2024Progressive WordPress (PWA): Missing AuthorizationCVE-2024-33937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13.
Product
Progressive WordPress (PWA)
Affected
up to 2.1.13
What to do
Affects up to 2.1.13. Update Progressive WordPress (PWA) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024JW Player for: Missing AuthorizationCVE-2024-33931 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3.
Product
JW Player for
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update JW Player for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Directorist: Missing AuthorizationCVE-2024-33929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6.
Product
Directorist
Affected
up to 7.8.6
What to do
Affects up to 7.8.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Embed Google Fonts: Missing AuthorizationCVE-2024-33925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0.
Product
Embed Google Fonts
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Embed Google Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024SP Project & Document Manager: Missing AuthorizationCVE-2024-33923 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.69.
Product
SP Project & Document Manager
Affected
up to 4.69
What to do
Affects up to 4.69. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Democracy Poll: Missing AuthorizationCVE-2024-33920 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3.
Product
Democracy Poll
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Democracy Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024RomethemeKit For Elementor: Missing AuthorizationCVE-2024-33919 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1.
Product
RomethemeKit For Elementor
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update RomethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Debug Log Manager: Missing AuthorizationCVE-2024-33915 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
Product
Debug Log Manager
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Debug Log Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Exclusive Addons Elementor: Missing AuthorizationCVE-2024-33914 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1.
Product
Exclusive Addons Elementor
Affected
up to 2.6.9.1
What to do
Affects up to 2.6.9.1. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-33941 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.1.
Product
iPanorama 360 WordPress Virtual Tour Builder
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024ShortPixel Critical CSS: Missing AuthorizationCVE-2024-32810 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2.
Product
ShortPixel Critical CSS
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update ShortPixel Critical CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Feed Them Social: Missing AuthorizationCVE-2024-24710 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SlickRemix Feed Them Social.This issue affects Feed Them Social: from n/a through 4.2.0.
Product
Feed Them Social
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Feed Them Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Unyson: Missing AuthorizationCVE-2023-44472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.28.
Product
Unyson
Affected
up to 2.7.28
What to do
Affects up to 2.7.28. Update Unyson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Slider Carousel – Responsive Image Slider: Missing AuthorizationCVE-2023-25457 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Richteam Slider Carousel – Responsive Image Slider.This issue affects Slider Carousel – Responsive Image Slider: from n/a through 1.5.1.
Product
Slider Carousel – Responsive Image Slider
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Slider Carousel – Responsive Image Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid: Unauthorized modification of dataCVE-2024-3936 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtTPGSaveSettings function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or higher, to change the plugin's settings and invoke other functions hooked by AJAX actions.
Product
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Popup Box – Best WordPress Popup: Unauthorized access of dataCVE-2024-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.
Product
Popup Box – Best WordPress Popup
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Popup Box – Best WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Datepicker: Unauthorized modification of dataCVE-2024-3895 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax() function in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options that can be used for privilege escalation. This was partially patched in 2.0.9 and 2.1.0, and fully patched in 2.1.1.
Product
WP Datepicker
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024PropertyHive: Unauthorized loss of dataCVE-2024-3607 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts
Product
PropertyHive
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024ProfileGrid – User Profiles, Memberships, Groups and Communities: Unauthorized deletion of dataCVE-2024-3606 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments.
Product
ProfileGrid – User Profiles, Memberships, Groups and Communities
Affected
up to 5.8.3
What to do
Affects up to 5.8.3. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Poll Maker – Best WordPress Poll: Unauthorized access of dataCVE-2024-3601 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll_create_author function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email addresses by enumerating them one character at a time.
Product
Poll Maker – Best WordPress Poll
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Poll Maker – Best WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Unauthorized loss of dataCVE-2024-3599 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Send PDF for Contact Form 7: Unauthorized access of form submissionsCVE-2024-3585 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entries with PDFs.
Product
Send PDF for Contact Form 7
Affected
up to 1.0.2.3
What to do
Affects up to 1.0.2.3. Update Send PDF for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024MaxGalleria: Unauthorized image uploadCVE-2024-3581 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the add_media_library_images_to_gallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to upload arbitrary images to a gallery.
Product
MaxGalleria
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update MaxGalleria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2024-3553 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WordPress Backup & Migration: Unauthorized access of dataCVE-2024-3546 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.
Product
WordPress Backup & Migration
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Country State City Dropdown CF7: Unauthorized modification of dataCVE-2024-3520 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tc_csca_patch_settings function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber access and above, to add states or cities to the dropdown.
Product
Country State City Dropdown CF7
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Country State City Dropdown CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Unauthorized loss of dataCVE-2024-3295 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
Product
User Registration – Custom Registration Form, Login Form, and User Profile
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update User Registration – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Unauthorized ld+json description injectionCVE-2024-3287 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticated attackers to save schema types.
Product
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Affected
up to 3.10.2
What to do
Affects up to 3.10.2. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Ivory Search – WordPress Search: Unauthorized modification of dataCVE-2024-3233 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_create_index() function in all versions up to, and including, 5.5.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger index creation.
Product
Ivory Search – WordPress Search
Affected
up to 5.5.5
What to do
Affects up to 5.5.5. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Different Menu in Different Pages – Control Menu Visibility (All in One): Unauthorized accessCVE-2024-3206 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Different Menu in Different Pages – Control Menu Visibility (All in One) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax() function in all versions up to, and including, 2.3.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to duplicate menus.
Product
Different Menu in Different Pages – Control Menu Visibility (All in One)
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Different Menu in Different Pages – Control Menu Visibility (All in One) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024ACF On-The-Go: Unauthorized modification of dataCVE-2024-3071 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ACF On-The-Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the acfg_update_fields() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post titles, descriptions, and ACF values.
Product
ACF On-The-Go
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update ACF On-The-Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024MailerLite – Signup forms (official): Unauthorized plugin setting changesCVE-2024-2797 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized plugin setting changes due to a missing capability check on the toggleRolesAndPermissions and editAllowedRolesAndPermissions functions in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to allow lower level users to modify forms.
Product
MailerLite – Signup forms (official)
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024EleForms – All In One Form Integration including DB for Elementor: Unauthorized access of dataCVE-2024-2043 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downloading form submissions in all versions up to, and including, 2.9.9.7. This makes it possible for unauthenticated attackers to view form submissions.
Product
EleForms – All In One Form Integration including DB for Elementor
Affected
up to 2.9.9.7
What to do
Affects up to 2.9.9.7. Update EleForms – All In One Form Integration including DB for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder: Unauthorized loss of dataCVE-2024-1945 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'arflite_remove_preview_data' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary site options, resulting in loss of availability.
Product
Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy): Unauthorized access of dataCVE-2024-1809 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings.
Product
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Admin Bar Remover: Unauthorized modification of dataCVE-2024-1716 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Admin Bar Remover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_form() function in all versions up to, and including, 1.0.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable or disable the admin bar on the front-end of the site.
Product
Admin Bar Remover
Affected
up to 1.0.2.2
What to do
Affects up to 1.0.2.2. Update Admin Bar Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Woo Total Sales: Unauthorized access of dataCVE-2024-1688 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_orders_archive() function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to retrieve sales reports for the store.
Product
Woo Total Sales
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Woo Total Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce: Unauthorized access of data, modification of data, and loss of dataCVE-2024-1677 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to an improper capability check on 42 separate AJAX functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with subscriber access and above, to fully control the plugin which includes the ability to modify plugin settings and profiles, and create, edit, retrieve, and delete templates and barcodes.
Product
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.