Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,160 results · page 126 of 204
Dec 9, 2024Pie Register Premium: Missing AuthorizationCVE-2024-52391 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
- Product
- Pie Register Premium
- Fixed in
- 3.8.3.3
- What to do
- Update Pie Register Premium to 3.8.3.3 or newer.
Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-41953 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.
- Product
- ProfilePress
- Affected
- up to 4.13.1
- What to do
- Affects up to 4.13.1. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Message Filter for Contact Form 7: Missing AuthorizationCVE-2024-54254 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.
- Product
- Message Filter for Contact Form 7
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Prodigy Commerce: Missing AuthorizationCVE-2024-54251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through <= 3.1.2.
- Product
- Prodigy Commerce
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Minimum and Maximum Quantity for WooCommerce: Missing AuthorizationCVE-2024-54227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCommerce: from n/a through <= 2.0.0.
- Product
- Minimum and Maximum Quantity for WooCommerce
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Minimum and Maximum Quantity for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024ARForms: Missing AuthorizationCVE-2024-54217 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1.
- Product
- ARForms
- Affected
- up to 6.4.1
- What to do
- Affects up to 6.4.1. Update ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2024-53819 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.0.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.0
- What to do
- Affects up to 20.8.0. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Tutor LMS Elementor Addons: Missing AuthorizationCVE-2024-53816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a through <= 2.1.5.
- Product
- Tutor LMS Elementor Addons
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024FloristPress: Missing AuthorizationCVE-2024-53798 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion.This issue affects FloristPress: from n/a through <= 7.3.0.
- Product
- FloristPress
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update FloristPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Chatter: Missing AuthorizationCVE-2024-53785 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Alexander Volkov Chatter.This issue affects Chatter: from n/a through 1.0.1.
- Product
- Chatter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Chatter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sweet Date: Missing AuthorizationCVE-2024-43222 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3.
- Product
- Sweet Date
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Sweet Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024My Sticky Elements: Missing AuthorizationCVE-2023-51362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.
- Product
- My Sticky Elements
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-51360 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-51359 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Conversios.io: Missing AuthorizationCVE-2023-51357 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 6.5.0.
- Product
- Conversios.io
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024MultiVendorX: Missing AuthorizationCVE-2023-51355 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through <= 4.0.23.
- Product
- MultiVendorX
- Affected
- up to 4.0.23
- What to do
- Affects up to 4.0.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-51353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through <= 1.10.19.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.19
- What to do
- Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Poll Maker: Missing AuthorizationCVE-2023-50904 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.8.0.
- Product
- Poll Maker
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Metform: Missing AuthorizationCVE-2023-50903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.
- Product
- Metform
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2023-50899 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.2.
- Product
- Product Catalog Enquiry for WooCommerce by MultiVendorX
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024User Feedback: Missing AuthorizationCVE-2023-50887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.0.10.
- Product
- User Feedback
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2023-50884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.1.5.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-50882 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2.
- Product
- ProfilePress
- Affected
- up to 4.13.2
- What to do
- Affects up to 4.13.2. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Filter by WBW: Missing AuthorizationCVE-2023-50877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0.
- Product
- Product Filter by WBW
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Molongui: Missing AuthorizationCVE-2023-50876 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Molongui: from n/a through 4.7.3.
- Product
- Molongui
- Affected
- up to 4.7.3
- What to do
- Affects up to 4.7.3. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Google Language Translator: Missing AuthorizationCVE-2023-50375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in edo888 Google Language Translator google-language-translator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Language Translator: from n/a through <= 6.0.19.
- Product
- Google Language Translator
- Affected
- up to 6.0.19
- What to do
- Affects up to 6.0.19. Update Google Language Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Alt Manager: Missing AuthorizationCVE-2023-50373 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through <= 1.6.1.
- Product
- Alt Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Alt Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Social Media Feather: Missing AuthorizationCVE-2023-49861 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in socialmediafeather Social Media Feather social-media-feather allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media Feather: from n/a through <= 2.1.3.
- Product
- Social Media Feather
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Social Media Feather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Login With Ajax: Missing AuthorizationCVE-2023-49859 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marcus (aka @msykes) Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through <= 4.1.
- Product
- Login With Ajax
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Login With Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Custom Login: Missing AuthorizationCVE-2023-49858 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Austin Custom Login custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login: from n/a through <= 4.1.0.
- Product
- Custom Login
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-49857 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.7.
- Product
- Awesome Support
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Smart Forms: Missing AuthorizationCVE-2023-49856 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84.
- Product
- Smart Forms
- Affected
- up to 2.6.84
- What to do
- Affects up to 2.6.84. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Square Thumbnails: Missing AuthorizationCVE-2023-49851 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ILMDESIGNS Square Thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square Thumbnails: from n/a through 1.1.1.
- Product
- Square Thumbnails
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Square Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Simple HTML Sitemap: Missing AuthorizationCVE-2023-49850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through 2.7.
- Product
- WP Simple HTML Sitemap
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Shortcoder: Missing AuthorizationCVE-2023-49849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in vaakash Shortcoder shortcoder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcoder: from n/a through <= 6.3.
- Product
- Shortcoder
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update Shortcoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2023-49848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy woo-aliexpress-dropshipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through <= 2.1.1.
- Product
- Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Redirects: Missing AuthorizationCVE-2023-49845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mattdeclaire Redirects redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirects: from n/a through <= 1.2.1.
- Product
- Redirects
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Post Duplicator: Missing AuthorizationCVE-2023-49835 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31.
- Product
- Post Duplicator
- Affected
- up to 2.31
- What to do
- Affects up to 2.31. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Site Reviews: Missing AuthorizationCVE-2023-49832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through <= 6.10.2.
- Product
- Site Reviews
- Affected
- up to 6.10.2
- What to do
- Affects up to 6.10.2. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024RegistrationMagic: Missing AuthorizationCVE-2023-49831 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 5.2.3.0.
- Product
- RegistrationMagic
- Affected
- up to 5.2.3.0
- What to do
- Affects up to 5.2.3.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Webflow Pages: Missing AuthorizationCVE-2023-49818 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Webflow Webflow Pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webflow Pages: from n/a through 1.0.8.
- Product
- Webflow Pages
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Webflow Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Flexible Woocommerce Checkout Field Editor: Missing AuthorizationCVE-2023-49817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
- Product
- Flexible Woocommerce Checkout Field Editor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Flexible Woocommerce Checkout Field Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Booking System: Missing AuthorizationCVE-2023-49758 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Roland Murg WP Booking System wp-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Booking System: from n/a through <= 2.0.19.2.
- Product
- WP Booking System
- Affected
- up to 2.0.19.2
- What to do
- Affects up to 2.0.19.2. Update WP Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-49757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.10.
- Product
- Awesome Support
- Affected
- up to 6.1.10
- What to do
- Affects up to 6.1.10. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Eventin: Missing AuthorizationCVE-2023-49756 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventin: from n/a through <= 3.3.52.
- Product
- Eventin
- Affected
- up to 3.3.52
- What to do
- Affects up to 3.3.52. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Elementor Timeline Widget: Missing AuthorizationCVE-2023-49755 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2.
- Product
- Elementor Timeline Widget
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Elementor Timeline Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Bulk Edit Post Titles: Missing AuthorizationCVE-2023-49754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Yogesh Pawar Bulk Edit Post Titles bulk-edit-post-titles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Edit Post Titles: from n/a through <= 5.0.0.
- Product
- Bulk Edit Post Titles
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Bulk Edit Post Titles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024PageLayer: Missing AuthorizationCVE-2023-49196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7.
- Product
- PageLayer
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Hubbub Lite: Missing AuthorizationCVE-2023-49193 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NerdPress Hubbub Lite social-pug allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hubbub Lite: from n/a through <= 1.30.0.
- Product
- Hubbub Lite
- Affected
- up to 1.30.0
- What to do
- Affects up to 1.30.0. Update Hubbub Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Enhanced Text Widget: Missing AuthorizationCVE-2023-49192 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cl272 Enhanced Text Widget enhanced-text-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through <= 1.6.3.
- Product
- Enhanced Text Widget
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Enhanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.