Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

484new WordPress flaws this week

393,009entries in the database

10,165 results · page 138 of 204

Aug 30, 2024Media Library Folders: Unauthorized accessCVE-2024-7858 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions related to managing media files and folder along with controlling settings.
Product
Media Library Folders
Affected
up to 8.2.3
What to do
Affects up to 8.2.3. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2024Tutor LMS Pro: Unauthorized administrative actions executionCVE-2024-5784 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc.
Product
Tutor LMS Pro
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tutorlms.com wordfence.com
Aug 29, 2024Droip: Incorrect AuthorizationCVE-2024-43954 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Incorrect Authorization vulnerability in Themeum Droip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Droip: from n/a through 1.1.1.
Product
Droip
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Maintenance & Coming Soon Redirect Animation: Authentication Bypass by SpoofingCVE-2024-43944 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: from n/a through <= 2.3.3.
Product
Maintenance & Coming Soon Redirect Animation
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Z Y N I T H: Missing AuthorizationCVE-2024-43940 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9.
Product
Z Y N I T H
Affected
up to 7.4.9
What to do
Affects up to 7.4.9. Update Z Y N I T H to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Z Y N I T H: Missing AuthorizationCVE-2024-43939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9.
Product
Z Y N I T H
Affected
up to 7.4.9
What to do
Affects up to 7.4.9. Update Z Y N I T H to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Unauthorized arbitrary file deletionCVE-2024-7856 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file' parameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files which can make remote code execution possible when wp-config.php is deleted.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.7.0.1
What to do
Affects up to 5.7.0.1. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024WP Accessibility Helper (WAH): Unauthorized modification of dataCVE-2024-5987 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contrast_variations' and 'save_empty_contrast_variations' functions in all versions up to, and including, 0.6.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these issues were patched in 0.6.2.8, though it broke functionality and the vendor has not responded to our follow-ups.
Product
WP Accessibility Helper (WAH)
Affected
up to 0.6.2.8
What to do
Affects up to 0.6.2.8. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: Unauthorized loss of dataCVE-2024-5857 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file_remove AJAX action in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to delete arbitrary media files.
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Affected
up to 3.7.3.2
What to do
Affects up to 3.7.3.2. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 28, 2024Permalink Manager Lite: Unauthorized access of dataCVE-2024-8195 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to extract sensitive data including password, title, and content of password-protected posts.
Product
Permalink Manager Lite
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: Unauthorized modification of dataCVE-2024-7447 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to upload arbitrary media to the site, even if no forms exist.
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Affected
up to 3.7.3.2
What to do
Affects up to 3.7.3.2. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Unauthorized modification of dataCVE-2024-8199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update API Key options.
Product
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Oxygen Builder: Unauthorized modification of dataCVE-2024-6688 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.
Product
Oxygen Builder
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record oxygenbuilder.com wordfence.com
Aug 26, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43916 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
Product
Zephyr Project Manager
Affected
up to 3.3.102
What to do
Affects up to 3.3.102. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Store Locator Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.
Product
Store Locator Plus
Affected
up to 2311.17.01
What to do
Affects up to 2311.17.01. Update Store Locator Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Leopard - WordPress offload media: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
Product
Leopard - WordPress offload media
Affected
up to 2.0.36
What to do
Affects up to 2.0.36. Update Leopard - WordPress offload media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Bit Form Pro: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.
Product
Bit Form Pro
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024myCred: Missing AuthorizationCVE-2024-43214 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
Product
myCred
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Flash & HTML5 Video: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
Product
Flash & HTML5 Video
Affected
up to 2.5.31
What to do
Affects up to 2.5.31. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024wpForo Forum: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43289 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
Product
wpForo Forum
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-6631 · WordPress plugins & themes · reported by WordfenceMedium 5
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2024WooCommerce Google Feed Manager: Unauthorized loss of dataCVE-2024-7258 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WooCommerce Google Feed Manager
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update WooCommerce Google Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2024WP SMS: Missing AuthorizationCVE-2024-43331 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3.
Product
WP SMS
Affected
up to 6.9.3
What to do
Affects up to 6.9.3. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2024Themify Builder: Unauthorized post duplicationCVE-2024-7836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.
Product
Themify Builder
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024WP Testimonial Widget: Unauthorized modification of dataCVE-2024-7390 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrder function in all versions up to, and including, 3.1. This makes it possible for unauthenticated attackers to change the order of testimonials.
Product
WP Testimonial Widget
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024Smart Online Order for Clover: Unauthorized loss of dataCVE-2024-7032 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndClean' function in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to deactivate the plugin and drop all plugin tables from the database.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2024Smart Online Order for Clover: Unauthorized modification of dataCVE-2024-7030 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update product and category descriptions, category titles and images, and sort order.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2024Event Espresso 4 Decaf – Event Registration Event Ticketing: Limited unauthorized plugin settings modificationCVE-2024-6883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.
Product
Event Espresso 4 Decaf – Event Registration Event Ticketing
Affected
up to 4.10.46.decaf
What to do
Affects up to 4.10.46.decaf. Update Event Espresso 4 Decaf – Event Registration Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access and deletion of dataCVE-2024-5941 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.14.1
What to do
Affects up to 3.14.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2024-5940 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2024-5939 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024Plugin Notes Plus: Missing AuthorizationCVE-2024-43326 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.
Product
Plugin Notes Plus
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Plugin Notes Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Icegram: Missing Authentication for Critical FunctionCVE-2024-43272 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24.
Product
Icegram
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Leopard - WordPress offload media: Missing AuthorizationCVE-2024-43256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in nouthemes Leopard - WordPress offload media allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
Product
Leopard - WordPress offload media
Affected
up to 2.0.36
What to do
Affects up to 2.0.36. Update Leopard - WordPress offload media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Bit Form Pro: Incorrect AuthorizationCVE-2024-43250 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4.
Product
Bit Form Pro
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024WHMpress: Missing AuthorizationCVE-2024-43247 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.
Product
WHMpress
Affected
up to 6.2-revision-5
What to do
Affects up to 6.2-revision-5. Update WHMpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Ultimate Membership Pro: Improper AuthenticationCVE-2024-43240 · WordPress plugins & themes · reported by PatchstackCritical 9.4
Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.
Product
Ultimate Membership Pro
Affected
up to 12.7
What to do
Affects up to 12.7. Update Ultimate Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024GEO my WP: Does not prevent unauthenticated attackers from including arbitrary files in PHP's execution contextCVE-2024-6330 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
Product
GEO my WP
Fixed in
4.5.0.2
What to do
Update GEO my WP to 4.5.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2024Propovoice CRM: Authorization Bypass Through User-Controlled KeyCVE-2024-43350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Propovoice Propovoice CRM.This issue affects Propovoice CRM: from n/a through 1.7.6.4.
Product
Propovoice CRM
Affected
up to 1.7.6.4
What to do
Affects up to 1.7.6.4. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43322 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
Product
Zephyr Project Manager
Affected
up to 3.3.100
What to do
Affects up to 3.3.100. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Stripe Payments For WooCommerce by Checkout: Authorization Bypass Through User-Controlled KeyCVE-2024-43315 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
Product
Stripe Payments For WooCommerce by Checkout
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2024-43288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
Product
wpForo Forum
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2024-43266 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.
Product
WP Job Portal
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Masteriyo - LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-43239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
Product
Masteriyo - LMS
Affected
up to 1.11.4
What to do
Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Sensei LMS: Missing AuthorizationCVE-2024-35686 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.
Product
Sensei LMS
Affected
up to 4.23.1
What to do
Affects up to 4.23.1. Update Sensei LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 17, 2024LadiApp plugn: Unauthorized modification of dataCVE-2023-4730 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.
Product
LadiApp plugn
Affected
up to 4.3
What to do
Affects up to 4.3. Update LadiApp plugn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4027 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4025 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4024 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 16, 2024The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability checCVE-2024-6500 · WordPress plugins & themes · reported by WordfenceCritical 10
The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read.
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.