Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

10,175 results · page 157 of 204

Mar 4, 2024SportsPress – Sports Club & League Manager: Unauthorized modification of dataCVE-2024-1178 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs
Product
SportsPress – Sports Club & League Manager
Affected
up to 2.7.17
What to do
Affects up to 2.7.17. Update SportsPress – Sports Club & League Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2024Build & Control Block Patterns – Boost up Gutenberg Editor: Unauthorized access of dataCVE-2024-1095 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the settings_export() function in all versions up to, and including, 1.3.5.4. This makes it possible for unauthenticated attackers to export the plugin's settings.
Product
Build & Control Block Patterns – Boost up Gutenberg Editor
Affected
up to 1.3.5.4
What to do
Affects up to 1.3.5.4. Update Build & Control Block Patterns – Boost up Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2024Change Memory Limit: Unauthorized modification of dataCVE-2024-1093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_logic() function hooked via admin_init in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update the memory limit.
Product
Change Memory Limit
Affected
up to 1.0
What to do
Affects up to 1.0. Update Change Memory Limit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2024Sirv: Missing AuthorizationCVE-2024-27950 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0.
Product
Sirv
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024Migration, Backup, Staging – WPvivid: Unauthorized accessCVE-2024-1982 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progress() and restore() functions in all versions up to, and including, 0.9.68. This makes it possible for unauthenticated attackers to exploit a SQL injection vulnerability or trigger a DoS.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.68
What to do
Affects up to 0.9.68. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.hisolutions.com
Feb 29, 2024Perfmatters: Missing AuthorizationCVE-2023-47874 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.
Product
Perfmatters
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024WPify Woo Czech: Unauthorized access of dataCVE-2024-1492 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.
Product
WPify Woo Czech
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update WPify Woo Czech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Login Lockdown – Protect Login Form: Unauthorized access of dataCVE-2024-1340 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
Product
Login Lockdown – Protect Login Form
Affected
up to 2.08
What to do
Affects up to 2.08. Update Login Lockdown – Protect Login Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024SKT Page Builder: Unauthorized modification of dataCVE-2024-1337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData' function in all versions up to, and including, 4.1. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary content into pages.
Product
SKT Page Builder
Affected
up to 4.1
What to do
Affects up to 4.1. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Unauthorized modification of dataCVE-2024-1322 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.8.4
What to do
Affects up to 7.8.4. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Unauthorized modification of dataCVE-2024-1318 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with Contributor access and above, who are normally restricted to only being able to create posts rather than pages, to draft and publish posts with arbitrary content.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Schema & Structured Data for WP & AMP: Unauthorized modification of dataCVE-2024-1288 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all versions up to, and including, 1.26. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's stored reCaptcha site and secret keys, potentially breaking the reCaptcha functionality.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.26
What to do
Affects up to 1.26. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Unauthorized access and modification of dataCVE-2024-1218 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.41
What to do
Affects up to 2.3.41. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Unauthorized plugin deactivationCVE-2024-1217 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.41
What to do
Affects up to 2.3.41. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Tutor LMS – eLearning and online course solution: Unauthorized access of restricted Q&A contentCVE-2024-1133 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-1130 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as read.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-1129 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as starred.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-1091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reinitialize function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to remove all plugin data.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-1090 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stopOptimizeAll function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify image optimization settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-1089 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optimizeAllOn function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify image optimization settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Customer Reviews for WooCommerce: Unauthorized modification of dataCVE-2024-1044 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.12
What to do
Affects up to 5.38.12. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024AMP for WP – Accelerated Mobile Pages: Unauthorized loss of dataCVE-2024-1043 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remove_saved_layout_data' function in all versions up to, and including, 1.0.93.1. This makes it possible for authenticated attackers, with contributor access and above, to delete arbitrary posts on the site.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.0.93.1
What to do
Affects up to 1.0.93.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-0984 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to disable the image optimization setting.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-0983 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable image optimization.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-0907 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restore_records() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to restore records.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Oliver POS – A WooCommerce Point of Sale (POS): Unauthorized accessCVE-2024-0702 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.
Product
Oliver POS – A WooCommerce Point of Sale (POS)
Affected
up to 2.4.2.1
What to do
Affects up to 2.4.2.1. Update Oliver POS – A WooCommerce Point of Sale (POS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Royal Elementor Addons and Templates: Unauthorized post metadata updateCVE-2024-0516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.87
What to do
Affects up to 1.3.87. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Customer Reviews for WooCommerce: Missing AuthorizationCVE-2023-51692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.1
What to do
Affects up to 5.38.1. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1861 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.52
What to do
Affects up to 4.52. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1860 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.51
What to do
Affects up to 4.51. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Redirects: Unauthorized modification of dataCVE-2024-1566 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Redirects plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to change redirects created with this plugin. This could lead to undesired redirection to phishing sites or malicious web pages.
Product
Redirects
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024WP eCommerce: Unauthorized arbitrary post creationCVE-2024-1516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrary content.
Product
WP eCommerce
Affected
up to 3.15.1
What to do
Affects up to 3.15.1. Update WP eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Page Duplicator: Unauthorized modification of dataCVE-2024-1368 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_dat_page() function in all versions up to, and including, 0.1.1. This makes it possible for unauthenticated attackers to duplicate arbitrary posts and pages.
Product
Page Duplicator
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Page Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Coming Soon Page & Maintenance Mode: Unauthorized access of dataCVE-2024-1136 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wpsm_coming_soon_redirect function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to view a site with maintenance mode or coming-soon mode enabled to view the site's content.
Product
Coming Soon Page & Maintenance Mode
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Envo's Elementor Templates & Widgets for WooCommerce: Unauthorized modification of dataCVE-2024-0766 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.
Product
Envo's Elementor Templates & Widgets for WooCommerce
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Envo's Elementor Templates & Widgets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Yuki: Unauthorized modification of dataCVE-2024-1388 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings.
Product
Yuki
Affected
up to 1.3.13
What to do
Affects up to 1.3.13. Update Yuki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1653 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosition in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the folder position of categories as well as update the metadata of other taxonomies.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1652 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear categories.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1650 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1649 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete categories.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Spiffy Calendar: Doesn't check the event_author parameterCVE-2024-0855 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
Product
Spiffy Calendar
Fixed in
4.9.9
What to do
Update Spiffy Calendar to 4.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2024Smart Forms: Does not have authorisation in various AJAX actionsCVE-2023-7203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
Product
Smart Forms
Fixed in
2.6.87
What to do
Update Smart Forms to 2.6.87 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2024Fatal Error Notify: Does not have authorisation and CSRF checks in its test_error AJAX actionCVE-2023-7202 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF
Product
Fatal Error Notify
Fixed in
1.5.3
What to do
Update Fatal Error Notify to 1.5.3 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Feb 27, 2024Thank You Page Customizer for WooCommerce – Increase Your Sales: Unauthorized execution of shortcodesCVE-2024-1687 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
Thank You Page Customizer for WooCommerce – Increase Your Sales
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Thank You Page Customizer for WooCommerce – Increase Your Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Thank You Page Customizer for WooCommerce – Increase Your Sales: Missing authorization eCVE-2024-1686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.
Product
Thank You Page Customizer for WooCommerce – Increase Your Sales
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Thank You Page Customizer for WooCommerce – Increase Your Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 26, 2024Addon Library: Unauthorized access of dataCVE-2024-1710 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions including uploading arbitrary files.
Product
Addon Library
Affected
up to 1.3.76
What to do
Affects up to 1.3.76. Update Addon Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 26, 2024WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-1436 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: from n/a through 1.0.9.
Product
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 23, 2024Admin side data storage for Contact Form 7: Unauthorized modification of dataCVE-2024-1779 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_status() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter the message read status of messages.
Product
Admin side data storage for Contact Form 7
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.