Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

10,175 results · page 159 of 204

Jan 17, 2024WIP Custom Login: Missing AuthorizationCVE-2022-42884 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7.
Product
WIP Custom Login
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WIP Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2022-41790 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.
Product
WP Time Slots Booking Form
Affected
up to 1.1.76
What to do
Affects up to 1.1.76. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024WP Job Portal – A Complete Job Board: Missing AuthorizationCVE-2022-41786 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.
Product
WP Job Portal – A Complete Job Board
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update WP Job Portal – A Complete Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024URL Shortener by MyThemeShop: Missing AuthorizationCVE-2023-23896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.
Product
URL Shortener by MyThemeShop
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update URL Shortener by MyThemeShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Ultimate Addons for Beaver Builder – Lite: Missing AuthorizationCVE-2023-23882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.5.
Product
Ultimate Addons for Beaver Builder – Lite
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Ultimate Addons for Beaver Builder – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Traffic Manager: Missing AuthorizationCVE-2022-41695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.
Product
Traffic Manager
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Traffic Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Image Zoom: Missing AuthorizationCVE-2022-41619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.
Product
Image Zoom
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update Image Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Advanced Local Pickup for WooCommerce: Missing AuthorizationCVE-2022-40702 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Cart2Cart: Magento to WooCommerce Migration: Missing AuthorizationCVE-2023-34379 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0.
Product
Cart2Cart: Magento to WooCommerce Migration
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Cart2Cart: Magento to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Advanced Dynamic Pricing for WooCommerce: Missing AuthorizationCVE-2022-40203 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.1.5.
Product
Advanced Dynamic Pricing for WooCommerce
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Advanced Dynamic Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Sales Report Email for WooCommerce: Missing AuthorizationCVE-2022-38141 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8.
Product
Sales Report Email for WooCommerce
Affected
up to 2.8
What to do
Affects up to 2.8. Update Sales Report Email for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024HREFLANG Tags Lite: Missing AuthorizationCVE-2022-36418 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.
Product
HREFLANG Tags Lite
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update HREFLANG Tags Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON paramCVE-2024-0405 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
Fixed in
1.5.3
What to do
Update the plugin to 1.5.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2024EventON Premium WordPress plugin before 4.5.6, EventON: Do not have authorisation in an AJAX actionCVE-2024-0238 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.
Product
EventON Premium WordPress plugin before 4.5.6, EventON
Fixed in
4.5.6
What to do
Update EventON Premium WordPress plugin before 4.5.6, EventON to 4.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin through 4.5.8, EventON: Do not have authorisation in some AJAX actionsCVE-2024-0237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc
Product
EventON WordPress plugin through 4.5.8, EventON
Affected
up to 4.5.8
Fixed in
2.2.7
What to do
Update EventON WordPress plugin through 4.5.8, EventON to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not have authorisation in an AJAX actionCVE-2024-0236 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including any meeting password set (for example for Zoom)
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not have authorisation in an AJAX actionCVE-2024-0235 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024T1: Is vulnerable to unauthenticated open redirect withCVE-2023-3771 · WordPress plugins & themes · reported by WPScanMedium 6.1
The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites.
Product
T1
Affected
up to 19.0
What to do
Affects up to 19.0. Update T1 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
WordPress Database Administrator
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Contact Form & Lead Form Elementor Builder: Doesn't have authorisation and nonce checksCVE-2022-23180 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings
Product
Contact Form & Lead Form Elementor Builder
Fixed in
1.7.4
What to do
Update Contact Form & Lead Form Elementor Builder to 1.7.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 16, 2024WPGraphQL WooCommerce: Does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQLCVE-2022-1563 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.
Product
WPGraphQL WooCommerce
Fixed in
0.12.4
What to do
Update WPGraphQL WooCommerce to 0.12.4 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jan 16, 2024WooCommerce: Does not have proper authorisation checkCVE-2022-0775 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment
Product
WooCommerce
Fixed in
6.2.1
What to do
Update WooCommerce to 6.2.1 or newer.
Full record and what to do →NVD record developer.woocommerce.com plugins.trac.wordpress.org
Jan 16, 2024WP Editor: Did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameterCVE-2021-24151 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
Product
WP Editor
Fixed in
1.2.7
What to do
Update WP Editor to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Essential Blocks: Does not prevent unauthenticated attackers from overwriting local variablesCVE-2023-6623 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.
Product
Essential Blocks
Fixed in
4.4.3
What to do
Update Essential Blocks to 4.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024EazyDocs: Does not have authorization and CSRF checksCVE-2023-6029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.
Product
EazyDocs
Fixed in
2.3.6
What to do
Update EazyDocs to 2.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024DeMomentSomTres WordPress Export Posts With Images: Does not check authorization of requests to export the blog dataCVE-2023-5905 · WordPress plugins & themes · reported by WPScanHigh 8.1
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.
Product
DeMomentSomTres WordPress Export Posts With Images
Affected
up to 20220825
What to do
Affects up to 20220825. Update DeMomentSomTres WordPress Export Posts With Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024LightStart – Maintenance Mode, Coming Soon and Landing Page Builder: Unauthorized modification of dataCVE-2023-7019 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.
Product
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update LightStart – Maintenance Mode, Coming Soon and Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Slick Social Share Buttons: Unauthorized modification of dataCVE-2023-6878 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssb_ajax_update' function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.
Product
Slick Social Share Buttons
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update Slick Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Unauthorized access of data and modification of dataCVE-2023-6875 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Unauthorized modification of membership levels created by the pluginCVE-2023-6855 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmpro_rest_api_get_permissions_check function in all versions up to 2.12.5 (inclusive). This makes it possible for unauthenticated attackers to change membership levels including prices.
Product
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected
up to 2.12.5
What to do
Affects up to 2.12.5. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Hostinger: Unauthorized plugin settings updateCVE-2023-6751 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
Product
Hostinger
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Hostinger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2023-6742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.8.7.1
What to do
Affects up to 1.8.7.1. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024GTG Product Feed for Shopping: Unauthorized modification of dataCVE-2023-6638 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.
Product
GTG Product Feed for Shopping
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update GTG Product Feed for Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024CAOS | Host Google Analytics Locally: Unauthorized modification of dataCVE-2023-6637 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 4.7.14. This makes it possible for unauthenticated attackers to update plugin settings.
Product
CAOS | Host Google Analytics Locally
Affected
up to 4.7.14
What to do
Affects up to 4.7.14. Update CAOS | Host Google Analytics Locally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024SpeedyCache: Unauthorized modification of dataCVE-2023-6598 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options.
Product
SpeedyCache
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update SpeedyCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized access of dataCVE-2023-6504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.10.7
What to do
Affects up to 3.10.7. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Manage Notification E-mails: Missing AuthorizationCVE-2023-6496 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.
Product
Manage Notification E-mails
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Manage Notification E-mails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Export WP Page to Static HTML/CSS: Unauthorized access of data and modification of dataCVE-2023-6369 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.
Product
Export WP Page to Static HTML/CSS
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Backup Migration: Unauthorized access of dataCVE-2023-6266 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
Product
Backup Migration
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Easy Social Feed: Unauthorized modification of dataCVE-2023-6883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's Facebook and Instagram access tokens and updating group IDs.
Product
Easy Social Feed
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Easy Social Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024WP 2FA – Two-factor authentication for: Cross-Site Request ForgeryCVE-2023-6520 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.
Product
WP 2FA – Two-factor authentication for
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP 2FA – Two-factor authentication for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024WP 2FA – Two-factor authentication for: Insecure Direct Object ReferenceCVE-2023-6506 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.
Product
WP 2FA – Two-factor authentication for
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP 2FA – Two-factor authentication for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2024EventON - WordPress Virtual Event Calendar: Unauthorized modification of data and loss of dataCVE-2023-6158 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection. CVE-2024-0238 appears to be a duplicate of this issue.
Product
EventON - WordPress Virtual Event Calendar
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update EventON - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.myeventon.com plugins.trac.wordpress.org
Jan 8, 2024Advanced Custom Fields (ACF): Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-40696 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
Product
Advanced Custom Fields (ACF)
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Advanced Custom Fields (ACF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024ProfileGrid – User Profiles, Memberships, Groups and Communities: Missing AuthorizationCVE-2022-36352 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.
Product
ProfileGrid – User Profiles, Memberships, Groups and Communities
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, DynamiCVE-2022-34344 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Database Cleaner: Clean, Optimize & Repair: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.
Product
Database Cleaner: Clean, Optimize & Repair
Affected
up to 0.9.8
What to do
Affects up to 0.9.8. Update Database Cleaner: Clean, Optimize & Repair to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Defender Security – Malware Scanner, Login Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
Product
Defender Security – Malware Scanner, Login Security & Firewall
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Defender Security – Malware Scanner, Login Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.
Product
WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024FastDup – Fastest WordPress Migration & Duplicator: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51406 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.
Product
FastDup – Fastest WordPress Migration & Duplicator
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update FastDup – Fastest WordPress Migration & Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.