Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,160 results · page 125 of 204
Dec 13, 2024WCP Contact Form: Missing AuthorizationCVE-2023-32519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.
- Product
- WCP Contact Form
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update WCP Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Woo Custom Emails: Missing AuthorizationCVE-2023-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2.
- Product
- Woo Custom Emails
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Woo Custom Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Link Whisper Free: Missing AuthorizationCVE-2023-32506 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3.
- Product
- Link Whisper Free
- Affected
- up to 0.6.3
- What to do
- Affects up to 0.6.3. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easing Slider: Missing AuthorizationCVE-2023-30490 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Matthew Ruddy Easing Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8.
- Product
- Easing Slider
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Easing Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Viral Mag: Missing AuthorizationCVE-2023-28990 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9.
- Product
- Viral Mag
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Viral Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Total: Missing AuthorizationCVE-2023-27456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.
- Product
- Total
- Affected
- up to 2.1.19
- What to do
- Affects up to 2.1.19. Update Total to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Video Gallery – YouTube Gallery: Missing AuthorizationCVE-2023-25988 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Video Gallery by Total-Soft Video Gallery – YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Gallery – YouTube Gallery: from n/a through 1.7.6.
- Product
- Video Gallery – YouTube Gallery
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Video Gallery – YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Survey Maker: Missing AuthorizationCVE-2023-22697 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Survey Maker team Survey Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through 3.2.0.
- Product
- Survey Maker
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2022-47594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Coming Soon Landing Page and Maintenance Mode: Missing AuthorizationCVE-2022-47429 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin allows Retrieve Embedded Sensitive Data.This issue affects Coming Soon Landing Page and Maintenance Mode WordPress Plugin: from n/a through 2.2.0.
- Product
- Coming Soon Landing Page and Maintenance Mode
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Coming Soon Landing Page and Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024APIExperts Square for WooCommerce: Missing AuthorizationCVE-2022-47182 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.
- Product
- APIExperts Square for WooCommerce
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Depicter Slider: Missing AuthorizationCVE-2022-47176 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.
- Product
- Depicter Slider
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Printful Integration for WooCommerce: Missing AuthorizationCVE-2022-47168 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in printful Printful Integration for WooCommerce printful-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a through <= 2.2.3.
- Product
- Printful Integration for WooCommerce
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Printful Integration for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Trending/Popular Post Slider and Widget: Missing AuthorizationCVE-2022-46846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a through 1.5.7.
- Product
- Trending/Popular Post Slider and Widget
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Trending/Popular Post Slider and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46840 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46838 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: Missing AuthorizationCVE-2022-46811 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 1.0.21.
- Product
- ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Stock Sync for WooCommerce: Missing AuthorizationCVE-2022-46807 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Sync for WooCommerce: from n/a through 2.3.2.
- Product
- Stock Sync for WooCommerce
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Stock Sync for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CURCY: Missing AuthorizationCVE-2022-46796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme CURCY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.1.25.
- Product
- CURCY
- Affected
- up to 2.1.25
- What to do
- Affects up to 2.1.25. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2022-46795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Robo Gallery: Missing AuthorizationCVE-2022-45841 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9.
- Product
- Robo Gallery
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Auto Affiliate Links: Missing AuthorizationCVE-2022-45840 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.
- Product
- Auto Affiliate Links
- Affected
- up to 6.2.1.5
- What to do
- Affects up to 6.2.1.5. Update Auto Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2022-45826 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.
- Product
- Sunshine Photo Cart
- Affected
- up to 2.9.13
- What to do
- Affects up to 2.9.13. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Popup Maker: Missing AuthorizationCVE-2022-45819 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1.
- Product
- Popup Maker
- Affected
- up to 1.17.1
- What to do
- Affects up to 1.17.1. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Formidable Forms: Missing AuthorizationCVE-2022-45806 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.
- Product
- Formidable Forms
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Owl Carousel: Missing AuthorizationCVE-2022-44578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3.
- Product
- Owl Carousel
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Owl Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024eRoom – Zoom Meetings & Webinar: Missing AuthorizationCVE-2022-43472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.
- Product
- eRoom – Zoom Meetings & Webinar
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update eRoom – Zoom Meetings & Webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Crowdfunding: Unauthorized plugin installationCVE-2024-11911 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 13, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Unauthorized loss of dataCVE-2024-11275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
- Product
- WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
- Affected
- up to 1.0.27
- What to do
- Affects up to 1.0.27. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024AR for: Unauthorized double extension file uploadCVE-2024-12300 · WordPress plugins & themes · reported by WordfenceLow 3.7
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.
- Product
- AR for
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update AR for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024Essential Real Estate: Unauthorized access of dataCVE-2024-12329 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
- Product
- Essential Real Estate
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Hash Form – Drag & Drop Form Builder: Unauthorized accessCVE-2024-12201 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
- Product
- Hash Form – Drag & Drop Form Builder
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy): Unauthorized modification of dataCVE-2024-11724 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpl_script_save AJAX action in all versions up to, and including, 3.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to whitelist scripts.
- Product
- Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy)
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Web3 Crypto Payments by DePay for WooCommerce: Unauthorized access of dataCVE-2024-12265 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation.
- Product
- Web3 Crypto Payments by DePay for WooCommerce
- Affected
- up to 2.12.17
- What to do
- Affects up to 2.12.17. Update Web3 Crypto Payments by DePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Child Theme Creator by Orbisius: Unauthorized modification of dataCVE-2024-12263 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete cloud snippets. Please note that this vulnerability was present in the Cloud Library Addon used by the plugin and not in the plugin itself, the cloud library has been removed entirely.
- Product
- Child Theme Creator by Orbisius
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Child Theme Creator by Orbisius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Unauthorized accessCVE-2024-12172 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
- Product
- WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
- Affected
- up to 3.2.21
- What to do
- Affects up to 3.2.21. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Snippet Shortcodes: Unauthorized Shortcode DeletionCVE-2024-12018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Shortcodes.
- Product
- Snippet Shortcodes
- Affected
- up to 4.1.6
- What to do
- Affects up to 4.1.6. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 12, 2024Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Unauthorized arbitrary plugin installation and activationCVE-2024-10124 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
- Product
- Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024AI Post Generator | AutoWriter: Unauthorized modification of dataCVE-2024-11709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary pages and posts.
- Product
- AI Post Generator | AutoWriter
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2024Custom Skins Contact Form 7: Unauthorized modification of dataCVE-2024-12341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7cs_action_callback' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the content of any post and create new skins.
- Product
- Custom Skins Contact Form 7
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Skins Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024WP Service Payment Form With Authorize.net: Reflected Cross-Site ScriptingCVE-2024-12258 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Service Payment Form With Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Service Payment Form With Authorize.net
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024de:branding: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11443 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the debranding_save() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- de:branding
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update de:branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2024Sign In With Google: Authentication bypassCVE-2024-11015 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticate_user' user function not implementing sufficient null value checks when setting the access token and user information. This makes it possible for unauthenticated attackers to log in as the first user who has signed in using Google OAuth, which could be the site administrator.
- Product
- Sign In With Google
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Sign In With Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024OAuth Single Sign On – SSO (OAuth Client): Authentication bypassCVE-2024-10111 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 6.26.3
- What to do
- Affects up to 6.26.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
- Product
- RapidLoad – Optimize Web Vitals Automatically
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024Notibar: Missing AuthorizationCVE-2024-54269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team Notibar notibar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notibar: from n/a through <= 2.1.4.
- Product
- Notibar
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Notibar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2024WPForms: Unauthorized modification of dataCVE-2024-11205 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.
- Product
- WPForms
- Affected
- up to 1.9.2.1
- What to do
- Affects up to 1.9.2.1. Update WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024AIO Contact: Missing AuthorizationCVE-2024-54218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.
- Product
- AIO Contact
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update AIO Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Analytify: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.
- Product
- Analytify
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Jobify: Missing AuthorizationCVE-2024-52480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Astoundify Jobify jobify.This issue affects Jobify: from n/a through < 4.3.0.
- Product
- Jobify
- Fixed in
- 4.2.4
- What to do
- Update Jobify to 4.2.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.