Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

10,175 results · page 153 of 204

Apr 18, 2024WP-Recall: Authorization Bypass Through User-Controlled KeyCVE-2024-32604 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.
Product
WP-Recall
Affected
up to 16.26.5
What to do
Affects up to 16.26.5. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Popup Anything: Missing AuthorizationCVE-2024-32601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8.
Product
Popup Anything
Affected
up to 2.8
What to do
Affects up to 2.8. Update Popup Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Ovic Responsive WPBakery: Missing AuthorizationCVE-2024-32142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ovic Team Ovic Responsive WPBakery.This issue affects Ovic Responsive WPBakery: from n/a through 1.3.0.
Product
Ovic Responsive WPBakery
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ovic Responsive WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Support Genix: Missing AuthorizationCVE-2023-49742 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3.
Product
Support Genix
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Uncode Core: Missing AuthorizationCVE-2023-51500 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8.
Product
Uncode Core
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024JVM rich text icons: Missing AuthorizationCVE-2023-51418 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6.
Product
JVM rich text icons
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update JVM rich text icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024If Menu: Missing AuthorizationCVE-2022-41698 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3.
Product
If Menu
Affected
up to 0.16.3
What to do
Affects up to 0.16.3. Update If Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Honeypot for WP Comment: Missing AuthorizationCVE-2024-1350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Prasidhda Malla Honeypot for WP Comment.This issue affects Honeypot for WP Comment: from n/a through 2.2.3.
Product
Honeypot for WP Comment
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Honeypot for WP Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Simple File List: Missing AuthorizationCVE-2023-44227 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.
Product
Simple File List
Affected
up to 6.1.9
What to do
Affects up to 6.1.9. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Data Tables Generator: Incorrect AuthorizationCVE-2023-25043 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25.
Product
Data Tables Generator
Affected
up to 1.10.25
What to do
Affects up to 1.10.25. Update Data Tables Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Speed Optimizer: Missing AuthorizationCVE-2024-32532 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.
Product
Speed Optimizer
Affected
up to 7.4.6
What to do
Affects up to 7.4.6. Update Speed Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Theme My Login: Missing AuthorizationCVE-2024-32525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
Product
Theme My Login
Affected
up to 7.1.6
What to do
Affects up to 7.1.6. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Custom Order Statuses for WooCommerce: Missing AuthorizationCVE-2024-32524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
Product
Custom Order Statuses for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Custom Order Statuses for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Open Close WooCommerce Store: Missing AuthorizationCVE-2024-32522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jaed Mosharraf & Pluginbazar Team Open Close WooCommerce Store.This issue affects Open Close WooCommerce Store: from n/a through 4.9.1.
Product
Open Close WooCommerce Store
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WPC Grouped Product for WooCommerce: Missing AuthorizationCVE-2024-32520 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Grouped Product for WooCommerce.This issue affects WPC Grouped Product for WooCommerce: from n/a through 4.4.2.
Product
WPC Grouped Product for WooCommerce
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WPC Grouped Product for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024GG Woo Feed for WooCommerce: Missing AuthorizationCVE-2024-32519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GutenGeek GG Woo Feed for WooCommerce.This issue affects GG Woo Feed for WooCommerce: from n/a through 1.2.6.
Product
GG Woo Feed for WooCommerce
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update GG Woo Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024PeproDev Ultimate Invoice: Missing AuthorizationCVE-2024-32518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.
Product
PeproDev Ultimate Invoice
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Custom Thank You Page Customize For WooCommerce by Binary Carpenter: Missing AuthorizationCVE-2024-32517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WooCommerce & WordPress Tutorials Custom Thank You Page Customize For WooCommerce by Binary Carpenter.This issue affects Custom Thank You Page Customize For WooCommerce by Binary Carpenter: from n/a through 1.4.12.
Product
Custom Thank You Page Customize For WooCommerce by Binary Carpenter
Affected
up to 1.4.12
What to do
Affects up to 1.4.12. Update Custom Thank You Page Customize For WooCommerce by Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Multi Currency For WooCommerce: Missing AuthorizationCVE-2024-32516 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through 1.5.5.
Product
Multi Currency For WooCommerce
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Multi Currency For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Mega Addons For Elementor: Missing AuthorizationCVE-2024-32515 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Qamar Sheeraz, Nasir Ahmad Mega Addons For Elementor.This issue affects Mega Addons For Elementor: from n/a through 1.8.
Product
Mega Addons For Elementor
Affected
up to 1.8
What to do
Affects up to 1.8. Update Mega Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP Cost Estimation & Payment Forms Builder: Missing AuthorizationCVE-2024-32509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.76.
Product
WP Cost Estimation & Payment Forms Builder
Affected
up to 10.1.76
What to do
Affects up to 10.1.76. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Radio Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32506 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Fatal Error Notify: Missing AuthorizationCVE-2024-32455 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Very Good Plugins Fatal Error Notify.This issue affects Fatal Error Notify: from n/a through 1.5.2.
Product
Fatal Error Notify
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Fatal Error Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024MoveTo: Missing AuthorizationCVE-2024-25911 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2.
Product
MoveTo
Affected
up to 6.2
What to do
Affects up to 6.2. Update MoveTo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024LiteSpeed Cache: Missing AuthorizationCVE-2023-45000 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.
Product
LiteSpeed Cache
Affected
up to 5.7
What to do
Affects up to 5.7. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Citadela Listing: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32086 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5.18.1.
Product
Citadela Listing
Affected
up to 5.18.1
What to do
Affects up to 5.18.1. Update Citadela Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Customer Reviews for WooCommerce: Unauthorized access of dataCVE-2024-3869 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_json_search_coupons' function . This makes it possible for attackers with subscriber level access to view coupon codes.
Product
Customer Reviews for WooCommerce
Fixed in
5.47.0
What to do
Update Customer Reviews for WooCommerce to 5.47.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2024Customer Reviews for WooCommerce: Unauthorized email sendingCVE-2024-3243 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and including, 5.46.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary test emails.
Product
Customer Reviews for WooCommerce
Affected
up to 5.46.0
What to do
Affects up to 5.46.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2024Popup by Supsystic: Missing AuthorizationCVE-2024-31421 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through <= 1.10.27.
Product
Popup by Supsystic
Affected
up to 1.10.27
What to do
Affects up to 1.10.27. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Restrict Content: Missing AuthorizationCVE-2024-31432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP Restrict Content.This issue affects Restrict Content: from n/a through 3.2.8.
Product
Restrict Content
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Social Author Bio: Cross-Site Request Forgery (CSRF)CVE-2024-30545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nick Powers Social Author Bio allows Stored XSS.This issue affects Social Author Bio: from n/a through 2.4.
Product
Social Author Bio
Affected
up to 2.4
What to do
Affects up to 2.4. Update Social Author Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Simple Buttons Creator: Does not have any authorisationCVE-2024-2857 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
Product
Simple Buttons Creator
Affected
up to 1.04
What to do
Affects up to 1.04. Update Simple Buttons Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Smart Forms: Does not have proper authorization in some actionsCVE-2024-1307 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
Product
Smart Forms
Fixed in
2.6.94
What to do
Update Smart Forms to 2.6.94 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 13, 2024WPZOOM Social Feed Widget & Block: Unauthorized accessCVE-2024-3662 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site.
Product
WPZOOM Social Feed Widget & Block
Affected
up to 2.1.13
What to do
Affects up to 2.1.13. Update WPZOOM Social Feed Widget & Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2024Smart Slider 3: Unauthorized modification of dataCVE-2024-3027 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
Product
Smart Slider 3
Affected
up to 3.5.1.22
What to do
Affects up to 3.5.1.22. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2024WP Job Manager: Missing AuthorizationCVE-2023-52211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0.
Product
WP Job Manager
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024Uncode Core: Missing AuthorizationCVE-2023-51515 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.
Product
Uncode Core
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024WooCommerce Shipping Per Product: Missing AuthorizationCVE-2023-51499 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WooCommerce WooCommerce Shipping Per Product.This issue affects WooCommerce Shipping Per Product: from n/a through 2.5.4.
Product
WooCommerce Shipping Per Product
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WooCommerce Shipping Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024Unauthenticated Cross Site Request Forgery (CSRF) in Post Views Counter <= 1.4.4 versions.CVE-2024-31264 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Post Views Counter <= 1.4.4 versions.
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel: Does not have proper authorizationCVE-2024-0881 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel
Fixed in
2.2.76
What to do
Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel to 2.2.76 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2024Easy!Appointments: Missing AuthorizationCVE-2023-32295 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.
Product
Easy!Appointments
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Easy!Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Inline Related Posts: Is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayedCVE-2023-6257 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
Product
Inline Related Posts
Fixed in
3.6.0
What to do
Update Inline Related Posts to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2024WP SendFox: Missing AuthorizationCVE-2024-27970 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BogdanFix WP SendFox.This issue affects WP SendFox: from n/a through 1.3.0.
Product
WP SendFox
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP SendFox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024RegistrationMagic: Missing AuthorizationCVE-2024-25935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.
Product
RegistrationMagic
Affected
up to 5.2.5.9
What to do
Affects up to 5.2.5.9. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Peach Payments Gateway: Missing AuthorizationCVE-2024-25922 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Peach Payments Peach Payments Gateway.This issue affects Peach Payments Gateway: from n/a through 3.1.9.
Product
Peach Payments Gateway
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024MoveTo: Missing AuthorizationCVE-2024-25912 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
Product
MoveTo
Affected
up to 6.2
What to do
Affects up to 6.2. Update MoveTo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Media folder: Missing AuthorizationCVE-2024-25908 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
Product
WP Media folder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update WP Media folder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Media folder: Missing AuthorizationCVE-2024-25907 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
Product
WP Media folder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update WP Media folder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-24883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.11.10
What to do
Affects up to 3.11.10. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Quicksand Post Filter jQuery: Missing AuthorizationCVE-2024-24850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.