Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

10,175 results · page 155 of 204

Mar 29, 2024Molongui: Authorization Bypass Through User-Controlled KeyCVE-2024-30507 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
Product
Molongui
Affected
up to 4.7.7
What to do
Affects up to 4.7.7. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Church Admin: Missing AuthorizationCVE-2024-30505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.
Product
Church Admin
Affected
up to 4.1.18
What to do
Affects up to 4.1.18. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-30487 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 5.1
What to do
Affects up to 5.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Responsive: Unauthorized modification of dataCVE-2024-2848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer.
Product
Responsive
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024OceanWP: Unauthorized access of dataCVE-2024-2476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys.
Product
OceanWP
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update OceanWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024Easy Appointments: Unauthorized modification of dataCVE-2024-2844 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders.
Product
Easy Appointments
Affected
up to 3.11.18
What to do
Affects up to 3.11.18. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2024Booster Elite for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
Product
Booster Elite for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Elite for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Booster Plus for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Product
Booster Plus for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Plus for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Colibri Page Builder: Missing AuthorizationCVE-2024-28004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248.
Product
Colibri Page Builder
Affected
up to 1.0.248
What to do
Affects up to 1.0.248. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Max Mega Menu: Missing AuthorizationCVE-2024-28003 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3.
Product
Max Mega Menu
Affected
up to 3.3
What to do
Affects up to 3.3. Update Max Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Networker - Tech News WordPress Theme with Dark Mode: Unauthorized modification of dataCVE-2024-2962 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_reload_nav_menu() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to modify the location of display menus.
Product
Networker - Tech News WordPress Theme with Dark Mode
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Networker - Tech News WordPress Theme with Dark Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Mar 26, 2024Community by PeepSo: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-27630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.0.9.0.
Product
Community by PeepSo
Affected
up to 6.0.9.0
What to do
Affects up to 6.0.9.0. Update Community by PeepSo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Upload Resume: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25965 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0.
Product
Upload Resume
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Multiple Page Generator Plugin – MPG: Missing AuthorizationCVE-2024-30235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WholesaleX: Missing AuthorizationCVE-2024-30234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WholesaleX: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-30233 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Radio Player: Missing AuthorizationCVE-2024-2906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024SalesKing: Missing AuthorizationCVE-2024-22156 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15.
Product
SalesKing
Affected
up to 1.6.15
What to do
Affects up to 1.6.15. Update SalesKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Void Contact Form 7 Widget For Elementor Page Builder: Missing AuthorizationCVE-2023-52214 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.
Product
Void Contact Form 7 Widget For Elementor Page Builder
Affected
up to 2.3
What to do
Affects up to 2.3. Update Void Contact Form 7 Widget For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WooCommerce Box Office: Missing AuthorizationCVE-2024-24799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2.
Product
WooCommerce Box Office
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update WooCommerce Box Office to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Location Picker at Checkout for WooCommerce: Missing AuthorizationCVE-2024-24719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce: from n/a through 1.8.9.
Product
Location Picker at Checkout for WooCommerce
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update Location Picker at Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024PropertyHive: Missing AuthorizationCVE-2024-24718 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.6.
Product
PropertyHive
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WooCommerce Conversion Tracking: Missing AuthorizationCVE-2024-24711 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.
Product
WooCommerce Conversion Tracking
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update WooCommerce Conversion Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024PopupAlly: Missing AuthorizationCVE-2024-23520 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AccessAlly PopupAlly.This issue affects PopupAlly: from n/a through 2.1.0.
Product
PopupAlly
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update PopupAlly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2024-24805 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 3.1.2.
Product
WP Dummy Content Generator
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Check & Log Email: Unauthenticated Hook InjectionCVE-2024-0866 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
Product
Check & Log Email
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Check & Log Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 25, 2024Points and Rewards for WooCommerce: Missing AuthorizationCVE-2023-27608 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
Product
Points and Rewards for WooCommerce
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Google Maps CP: Missing AuthorizationCVE-2023-25039 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43.
Product
Google Maps CP
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Google Maps CP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024MainWP Wordfence Extension: Missing AuthorizationCVE-2023-22699 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.This issue affects MainWP Wordfence Extension: from n/a through 4.0.7.
Product
MainWP Wordfence Extension
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update MainWP Wordfence Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024ShareThis Dashboard for Google Analytics: Missing AuthorizationCVE-2022-45851 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through 3.1.4.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45352 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45351 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45349 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024SEO Plugin by Squirrly SEO: Missing AuthorizationCVE-2022-44626 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.1.20
What to do
Affects up to 12.1.20. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-38057 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
Product
Advance WordPress Search
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024RealHomes: Missing AuthorizationCVE-2023-37886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2.
Product
RealHomes
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update RealHomes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024RealHomes: Missing AuthorizationCVE-2023-37885 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2.
Product
RealHomes
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update RealHomes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Viral News: Missing AuthorizationCVE-2023-33923 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral: from n/a through 1.8.0; HashOne: from n/a through 1.3.0.
Product
Viral News
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Viral News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Educenter: Missing AuthorizationCVE-2023-30480 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5.
Product
Educenter
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Educenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024Element Pack Elementor Addons: Missing AuthorizationCVE-2024-24840 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.4.11.
Product
Element Pack Elementor Addons
Affected
up to 5.4.11
What to do
Affects up to 5.4.11. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024BEAR: Missing AuthorizationCVE-2024-24835 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.
Product
BEAR
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024EventPrime: Missing AuthorizationCVE-2024-24832 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Product
EventPrime
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Download Media: Missing AuthorizationCVE-2024-27190 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2.
Product
Download Media
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Download Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024WP 2FA: Improper AuthenticationCVE-2022-44595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
Product
WP 2FA
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WP 2FA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Tutor LMS – eLearning and online course solution: Unauthorized loss of dataCVE-2024-1502 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Word Replacer Pro: Missing AuthorizationCVE-2023-52229 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0.
Product
Word Replacer Pro
Affected
up to 1.0
What to do
Affects up to 1.0. Update Word Replacer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Olive One Click Demo Import: Missing AuthorizationCVE-2024-2702 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
Product
Olive One Click Demo Import
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Olive One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024RevivePress – Keep your Old Content Evergreen: Unauthorized access and modification of dataCVE-2024-1844 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RevivePress – Keep your Old Content Evergreen plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the import_data and copy_data functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with subscriber-level access or higher, to overwrite plugin settings and view them.
Product
RevivePress – Keep your Old Content Evergreen
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update RevivePress – Keep your Old Content Evergreen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Order Tip for WooCommerce: Unauthorized access of dataCVE-2024-1119 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Order Tip for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_tips_to_csv() function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to export the plugin's order fees.
Product
Order Tip for WooCommerce
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Order Tip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.