Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,160 results · page 128 of 204
Dec 9, 2024Stamped.io Product Reviews & UGC for WooCommerce: Missing AuthorizationCVE-2023-30479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.3.2.
- Product
- Stamped.io Product Reviews & UGC for WooCommerce
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Stamped.io Product Reviews & UGC for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
- Product
- Blogger Buzz
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024tencentcloud-cos: Missing AuthorizationCVE-2023-29433 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 腾讯云 tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7.
- Product
- tencentcloud-cos
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update tencentcloud-cos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024qTranslate X Cleanup and WPML Import: Missing AuthorizationCVE-2023-29431 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1.
- Product
- qTranslate X Cleanup and WPML Import
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update qTranslate X Cleanup and WPML Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024User Registration: Missing AuthorizationCVE-2023-29429 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 2.3.2.1.
- Product
- User Registration
- Affected
- up to 2.3.2.1
- What to do
- Affects up to 2.3.2.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Dynamics 365 Integration: Missing AuthorizationCVE-2023-29422 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13.
- Product
- Dynamics 365 Integration
- Affected
- up to 1.3.13
- What to do
- Affects up to 1.3.13. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024LuckyWP Scripts Control: Missing AuthorizationCVE-2023-29239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1.
- Product
- LuckyWP Scripts Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update LuckyWP Scripts Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Remove Duplicate Posts: Missing AuthorizationCVE-2023-29237 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5.
- Product
- Remove Duplicate Posts
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Remove Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Category Tree: Missing AuthorizationCVE-2023-29173 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.
- Product
- Product Category Tree
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Product Category Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024JS Job Manager: Missing AuthorizationCVE-2023-28689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.
- Product
- JS Job Manager
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Branded Social Images: Missing AuthorizationCVE-2023-28536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.
- Product
- Branded Social Images
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Branded Social Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Real Estate Directory: Missing AuthorizationCVE-2023-28532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5.
- Product
- Real Estate Directory
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Dynamics 365 Integration: Missing AuthorizationCVE-2023-28417 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.
- Product
- Dynamics 365 Integration
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Chankhe: Missing AuthorizationCVE-2023-28416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5.
- Product
- Chankhe
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Chankhe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Console: Missing AuthorizationCVE-2023-28168 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9.
- Product
- WordPress Console
- Affected
- up to 0.3.9
- What to do
- Affects up to 0.3.9. Update WordPress Console to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Backup Bank: WordPress Backup: Missing AuthorizationCVE-2023-28165 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: from n/a through 4.0.28.
- Product
- Backup Bank: WordPress Backup
- Affected
- up to 4.0.28
- What to do
- Affects up to 4.0.28. Update Backup Bank: WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stock Ticker: Missing AuthorizationCVE-2023-27626 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aleksandar Urošević Stock Ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Ticker: from n/a through 3.23.0.
- Product
- Stock Ticker
- Affected
- up to 3.23.0
- What to do
- Affects up to 3.23.0. Update Stock Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Site Reviews: Missing AuthorizationCVE-2023-27625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.5.0.
- Product
- Site Reviews
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Rife Elementor Extensions & Templates: Missing AuthorizationCVE-2023-27454 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.
- Product
- Rife Elementor Extensions & Templates
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Total Poll Lite: Missing AuthorizationCVE-2023-27449 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through 4.8.6.
- Product
- Total Poll Lite
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP users media: Missing AuthorizationCVE-2023-27428 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP users media: from n/a through 4.2.3.
- Product
- WP users media
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WP users media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Repost: Missing AuthorizationCVE-2023-26522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1.
- Product
- WP Repost
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP Repost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Advanced Text Widget: Missing AuthorizationCVE-2023-26520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2.
- Product
- Advanced Text Widget
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Advanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Top 10: Missing AuthorizationCVE-2023-25993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: from n/a through 3.2.3.
- Product
- Top 10
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Top 10 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Filebird: Missing AuthorizationCVE-2023-25966 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.
- Product
- Filebird
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Apollo13 Framework Extensions: Missing AuthorizationCVE-2023-25959 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.8.10
- What to do
- Affects up to 1.8.10. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fontiran: Missing AuthorizationCVE-2023-25791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran: from n/a through 2.1.
- Product
- Fontiran
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Fontiran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Paypal Payments: Missing AuthorizationCVE-2023-25714 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
- Product
- Quick Paypal Payments
- Affected
- up to 5.7.25
- What to do
- Affects up to 5.7.25. Update Quick Paypal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Meta slider and carousel with lightbox: Missing AuthorizationCVE-2023-25703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2.
- Product
- Meta slider and carousel with lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Clone: Missing AuthorizationCVE-2023-25486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7.
- Product
- Clone
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Table of Contents: Missing AuthorizationCVE-2023-25469 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2.
- Product
- Easy Table of Contents
- Affected
- up to 2.0.45.2
- What to do
- Affects up to 2.0.45.2. Update Easy Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-25455 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Protected Posts Logout Button: Missing AuthorizationCVE-2023-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5.
- Product
- Protected Posts Logout Button
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Protected Posts Logout Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024We’re Open!: Missing AuthorizationCVE-2023-25067 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Noah Hearle, Design Extreme We’re Open! allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects We’re Open!: from n/a through 1.45.
- Product
- We’re Open!
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update We’re Open! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Album and Image Gallery plus Lightbox: Missing AuthorizationCVE-2023-25060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through 1.6.2.
- Product
- Album and Image Gallery plus Lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Album and Image Gallery plus Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fantastic Content Protector Free: Missing AuthorizationCVE-2023-25048 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fantastic Content Protector Free: from n/a through 2.6.
- Product
- Fantastic Content Protector Free
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Fantastic Content Protector Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Booking Calendar Contact Form: Missing AuthorizationCVE-2023-25037 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.
- Product
- Booking Calendar Contact Form
- Affected
- up to 1.2.34
- What to do
- Affects up to 1.2.34. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Contact Form: Missing AuthorizationCVE-2023-25035 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8.0.3.1.
- Product
- Quick Contact Form
- Affected
- up to 8.0.3.1
- What to do
- Affects up to 8.0.3.1. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024PayPal Brasil para WooCommerce: Missing AuthorizationCVE-2023-25026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.
- Product
- PayPal Brasil para WooCommerce
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update PayPal Brasil para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2023-24407 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-24375 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.5.14
- What to do
- Affects up to 7.5.14. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Reviews and Rating – Google My Business: Missing AuthorizationCVE-2023-23986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.14.
- Product
- Reviews and Rating – Google My Business
- Affected
- up to 4.14
- What to do
- Affects up to 4.14. Update Reviews and Rating – Google My Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Event Manager: Missing AuthorizationCVE-2023-23975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4.
- Product
- Quick Event Manager
- Affected
- up to 9.7.4
- What to do
- Affects up to 9.7.4. Update Quick Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2023-23895 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.1.82
- What to do
- Affects up to 1.1.82. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Simple Giveaways: Missing AuthorizationCVE-2023-23893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0.
- Product
- Simple Giveaways
- Affected
- up to 2.48.0
- What to do
- Affects up to 2.48.0. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Google Analytics for: Missing AuthorizationCVE-2023-23887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0.
- Product
- Easy Google Analytics for
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Easy Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP-RecentComments: Missing AuthorizationCVE-2023-23886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7.
- Product
- WP-RecentComments
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update WP-RecentComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Cost of Goods for WooCommerce: Missing AuthorizationCVE-2023-23868 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.
- Product
- Cost of Goods for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Cost of Goods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Spectra: Missing AuthorizationCVE-2023-23834 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
- Product
- Spectra
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Spectra: Missing AuthorizationCVE-2023-23825 · WordPress plugins & themes · reported by PatchstackLow 3.1
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
- Product
- Spectra
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.