Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,160 results · page 127 of 204
Dec 9, 2024Database for CF7: Missing AuthorizationCVE-2023-49167 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in code4life Database for CF7 database-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database for CF7: from n/a through <= 1.2.4.
- Product
- Database for CF7
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Database for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024GoDaddy Email Marketing: Missing AuthorizationCVE-2023-49156 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoDaddy GoDaddy Email Marketing godaddy-email-marketing-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDaddy Email Marketing: from n/a through <= 1.4.3.
- Product
- GoDaddy Email Marketing
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update GoDaddy Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Button Generator – easily Button Builder: Missing AuthorizationCVE-2023-49154 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.
- Product
- Button Generator – easily Button Builder
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024360 Javascript Viewer: Missing AuthorizationCVE-2023-48779 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 3DWeb 360 Javascript Viewer 360deg-javascript-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript Viewer: from n/a through <= 1.7.11.
- Product
- 360 Javascript Viewer
- Affected
- up to 1.7.11
- What to do
- Affects up to 1.7.11. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024canvasio3D Light: Missing AuthorizationCVE-2023-48776 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in virtuellwerk canvasio3D Light canvasio3d-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects canvasio3D Light: from n/a through <= 2.5.0.
- Product
- canvasio3D Light
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update canvasio3D Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024IdeaPush: Missing AuthorizationCVE-2023-48774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Martin Gibson IdeaPush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through n/a.
- Product
- IdeaPush
- Fixed in
- 8.58
- What to do
- Update IdeaPush to 8.58 or newer.
Dec 9, 2024Void Elementor Post Grid Addon for Elementor Page builder: Missing AuthorizationCVE-2023-48750 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in voidthemes Void Elementor Post Grid Addon for Elementor Page builder void-elementor-post-grid-addon-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through <= 2.1.10.
- Product
- Void Elementor Post Grid Addon for Elementor Page builder
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Social Feed: Missing AuthorizationCVE-2023-48740 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sajid Javed Easy Social Feed easy-facebook-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Feed: from n/a through <= 6.5.1.
- Product
- Easy Social Feed
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update Easy Social Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Mail Bank - #1 Mail SMTP Plugin for: Missing AuthorizationCVE-2023-48332 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress wp-mail-bank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mail Bank - #1 Mail SMTP Plugin for WordPress: from n/a through <= 4.0.14.
- Product
- Mail Bank - #1 Mail SMTP Plugin for
- Affected
- up to 4.0.14
- What to do
- Affects up to 4.0.14. Update Mail Bank - #1 Mail SMTP Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-48324 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.4.
- Product
- Awesome Support
- Affected
- up to 6.1.4
- What to do
- Affects up to 6.1.4. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024TextMe SMS: Missing AuthorizationCVE-2023-48287 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.0.
- Product
- TextMe SMS
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update TextMe SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stripe Payments: Missing AuthorizationCVE-2023-48286 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in mra13 Stripe Payments stripe-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through <= 2.0.79.
- Product
- Stripe Payments
- Affected
- up to 2.0.79
- What to do
- Affects up to 2.0.79. Update Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Super Progressive Web Apps: Missing AuthorizationCVE-2023-48277 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.
- Product
- Super Progressive Web Apps
- Affected
- up to 2.2.21
- What to do
- Affects up to 2.2.21. Update Super Progressive Web Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WCMultiShipping: Missing AuthorizationCVE-2023-48274 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5.
- Product
- WCMultiShipping
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WCMultiShipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Contact Form to Any API: Missing AuthorizationCVE-2023-47871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.
- Product
- Contact Form to Any API
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024BlossomThemes Email Newsletter: Missing AuthorizationCVE-2023-47849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.
- Product
- BlossomThemes Email Newsletter
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024PayTR Taksit Tablosu: Missing AuthorizationCVE-2023-47847 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayTR Taksit Tablosu: from n/a through 1.3.1.
- Product
- PayTR Taksit Tablosu
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PayTR Taksit Tablosu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Analytify: Missing AuthorizationCVE-2023-47841 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Analytify Analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through 5.1.1.
- Product
- Analytify
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Conditional Fields for Contact Form 7: Missing AuthorizationCVE-2023-47838 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.1.
- Product
- Conditional Fields for Contact Form 7
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Meta and Date Remover: Missing AuthorizationCVE-2023-47836 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in prasadkirpekar WP Meta and Date Remover wp-meta-and-date-remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through <= 2.3.0.
- Product
- WP Meta and Date Remover
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Meta and Date Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024SearchIQ: Missing AuthorizationCVE-2023-47832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SearchIQ SearchIQ searchiq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through <= 4.4.
- Product
- SearchIQ
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Live Preview for Contact Form 7: Missing AuthorizationCVE-2023-47830 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0.
- Product
- Live Preview for Contact Form 7
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Live Preview for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Restaurant & Cafe Addon for Elementor: Missing AuthorizationCVE-2023-47826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.3.
- Product
- Restaurant & Cafe Addon for Elementor
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024FormCraft: Missing AuthorizationCVE-2023-47823 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7.
- Product
- FormCraft
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2023-47822 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.
- Product
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Affected
- up to 4.10
- What to do
- Affects up to 4.10. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Like Button: Missing AuthorizationCVE-2023-47820 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CRUDLab WP Like Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Like Button: from n/a through 1.7.0.
- Product
- WP Like Button
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update WP Like Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WPCafe: Missing AuthorizationCVE-2023-47805 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 2.2.22.
- Product
- WPCafe
- Affected
- up to 2.2.22
- What to do
- Affects up to 2.2.22. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Acme Fix Images: Missing AuthorizationCVE-2023-47793 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.
- Product
- Acme Fix Images
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Acme Fix Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024EasyAzon: Missing AuthorizationCVE-2023-47780 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flowdee EasyAzon easyazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through <= 5.1.0.
- Product
- EasyAzon
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update EasyAzon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024miniorange otp verification: Missing AuthorizationCVE-2023-47776 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.
- Product
- miniorange otp verification
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update miniorange otp verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Ditty: Missing AuthorizationCVE-2023-47764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.
- Product
- Ditty
- Affected
- up to 3.1.24
- What to do
- Affects up to 3.1.24. Update Ditty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Custom Admin Interface: Missing AuthorizationCVE-2023-47763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.31.
- Product
- WP Custom Admin Interface
- Affected
- up to 7.31
- What to do
- Affects up to 7.31. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024BetterDocs: Missing AuthorizationCVE-2023-47762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.
- Product
- BetterDocs
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Simple 301 Redirects by BetterLinks: Missing AuthorizationCVE-2023-47761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0.7.
- Product
- Simple 301 Redirects by BetterLinks
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Simple 301 Redirects by BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-47760 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Welcome Email Editor: Missing AuthorizationCVE-2023-47756 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.
- Product
- Welcome Email Editor
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Welcome Email Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Japanized For WooCommerce: Missing AuthorizationCVE-2023-47698 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.4.
- Product
- Japanized For WooCommerce
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Mini Cart Drawer For WooCommerce: Missing AuthorizationCVE-2023-47694 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.
- Product
- Mini Cart Drawer For WooCommerce
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Mini Cart Drawer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Ni WooCommerce Sales Report: Missing AuthorizationCVE-2023-32299 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Sales Report ni-woocommerce-sales-report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through <= 3.7.3.
- Product
- Ni WooCommerce Sales Report
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Ni WooCommerce Sales Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WRC Pricing Tables: Missing AuthorizationCVE-2023-32293 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7.
- Product
- WRC Pricing Tables
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update WRC Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024SALERT: Missing AuthorizationCVE-2023-32126 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPoperation SALERT allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALERT: from n/a through 1.2.1.
- Product
- SALERT
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update SALERT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-32117 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.
- Product
- Integrate Google Drive
- Affected
- up to 1.1.99
- What to do
- Affects up to 1.1.99. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Extended Post Status: Missing AuthorizationCVE-2023-32094 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.
- Product
- Extended Post Status
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Extended Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Quick Post Duplicator: Missing AuthorizationCVE-2023-31214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0.
- Product
- WP Quick Post Duplicator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
- Product
- Display custom fields in the frontend – Post and User Profile Fields
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Docs: Missing AuthorizationCVE-2023-30873 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.
- Product
- WP Docs
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sharkdropship for AliExpress Dropship and Affiliate: Missing AuthorizationCVE-2023-30870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3.
- Product
- Sharkdropship for AliExpress Dropship and Affiliate
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Sharkdropship for AliExpress Dropship and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Smart WooCommerce Search: Missing AuthorizationCVE-2023-30783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.
- Product
- Smart WooCommerce Search
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Smart WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Featured Post Creative: Missing AuthorizationCVE-2023-30488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.
- Product
- Featured Post Creative
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Square: Missing AuthorizationCVE-2023-30486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.
- Product
- Square
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.