Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

3,631 results · page 28 of 73

Jan 7, 2025Admin debug wordpress – enable debug: Cross-Site Request Forgery (CSRF)CVE-2025-22503 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in digitalzoomstudio Admin debug wordpress – enable debug dzs-enable-debug allows Cross Site Request Forgery.This issue affects Admin debug wordpress – enable debug: from n/a through <= 1.0.13.
Product
Admin debug wordpress – enable debug
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Admin debug wordpress – enable debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025BSK Forms Blacklist: Cross-Site Request Forgery (CSRF)CVE-2025-22347 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through <= 3.9.
Product
BSK Forms Blacklist
Affected
up to 3.9
What to do
Affects up to 3.9. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025wpSOL: Cross-Site Request Forgery (CSRF)CVE-2025-22343 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.
Product
wpSOL
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update wpSOL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP Simple Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-22342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jenst WP Simple Sitemap wp-simple-sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a through <= 0.2.
Product
WP Simple Sitemap
Affected
up to 0.2
What to do
Affects up to 0.2. Update WP Simple Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Wizhi Multi Filters by Wenprise: Cross-Site Request Forgery (CSRF)CVE-2025-22336 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Amos Lee（一刀） Wizhi Multi Filters by Wenprise wizhi-multi-filters allows Stored XSS.This issue affects Wizhi Multi Filters by Wenprise: from n/a through <= 1.8.6.
Product
Wizhi Multi Filters by Wenprise
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Wizhi Multi Filters by Wenprise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Elevio: Cross-Site Request Forgery (CSRF)CVE-2025-22328 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Elevio by Dixa Elevio elevio allows Stored XSS.This issue affects Elevio: from n/a through <= 4.4.1.
Product
Elevio
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Elevio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Autocompleter: Cross-Site Request Forgery (CSRF)CVE-2025-22325 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nchankov Autocompleter autocompleter allows Stored XSS.This issue affects Autocompleter: from n/a through <= 1.3.5.2.
Product
Autocompleter
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update Autocompleter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025MyBookTable Bookstore: Cross-Site Request Forgery (CSRF)CVE-2025-22301 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in zookatron MyBookTable Bookstore mybooktable allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore: from n/a through <= 3.5.3.
Product
MyBookTable Bookstore
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025PixelYourSite – Your smart PIXEL (TAG) Manager: Cross-Site Request Forgery (CSRF)CVE-2025-22300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 10.0.1.2.
Product
PixelYourSite – Your smart PIXEL (TAG) Manager
Affected
up to 10.0.1.2
What to do
Affects up to 10.0.1.2. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025AI WP Writer: Cross-Site Request Forgery (CSRF)CVE-2025-22297 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in aipost AI WP Writer ai-wp-writer allows Cross Site Request Forgery.This issue affects AI WP Writer: from n/a through <= 3.8.4.4.
Product
AI WP Writer
Affected
up to 3.8.4.4
What to do
Affects up to 3.8.4.4. Update AI WP Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Bus Ticket Booking with Seat Reservation: Cross-Site Request Forgery (CSRF)CVE-2024-49294 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Cross Site Request Forgery.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.4.3.
Product
Bus Ticket Booking with Seat Reservation
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Patricia Blog: Cross-Site Request Forgery (CSRF)CVE-2024-38732 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through 1.2.
Product
Patricia Blog
Affected
up to 1.2
What to do
Affects up to 1.2. Update Patricia Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025i-amaze: Cross-Site Request Forgery (CSRF)CVE-2024-38731 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7.
Product
i-amaze
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update i-amaze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Point: Cross-Site Request Forgery (CSRF)CVE-2024-37931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1.
Product
Point
Affected
up to 1.1
What to do
Affects up to 1.1. Update Point to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025BuddyBoss: Cross-Site Request Forgery (CSRF)CVE-2024-37925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a through 2.4.61.
Product
BuddyBoss
Affected
up to 2.4.61
What to do
Affects up to 2.4.61. Update BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Schema Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37452 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop Schema Lite allows Cross Site Request Forgery.This issue affects Schema Lite: from n/a through 1.2.2.
Product
Schema Lite
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Schema Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Uncanny Toolkit Pro for LearnDash: Cross-Site Request Forgery (CSRF)CVE-2024-37438 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.
Product
Uncanny Toolkit Pro for LearnDash
Fixed in
4.1.4.1
What to do
Update Uncanny Toolkit Pro for LearnDash to 4.1.4.1 or newer.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Job Manager - Resume Manager: Cross-Site Request Forgery (CSRF)CVE-2024-37241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
Product
WP Job Manager - Resume Manager
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025FS Poster: Cross-Site Request Forgery (CSRF)CVE-2024-37237 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in fs-code FS Poster fs-poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through <= 6.5.8.
Product
FS Poster
Affected
up to 6.5.8
What to do
Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025ListingPro: Cross-Site Request Forgery (CSRF)CVE-2024-39623 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.
Product
ListingPro
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2024-38778 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.69.234.
Product
WP Fast Total Search
Affected
up to 1.69.234
What to do
Affects up to 1.69.234. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025i-transform: Cross-Site Request Forgery (CSRF)CVE-2024-38764 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9.
Product
i-transform
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update i-transform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Event Espresso 4 Decaf: Cross-Site Request Forgery (CSRF)CVE-2024-56251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.28.decaf.
Product
Event Espresso 4 Decaf
Affected
up to 5.0.28.decaf
What to do
Affects up to 5.0.28.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Email Address Encoder: Cross-Site Request Forgery (CSRF)CVE-2024-43927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through <= 1.0.23.
Product
Email Address Encoder
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Smartsupp – live chat, chatbots, AI and lead generation: Cross-Site Request Forgery (CSRF)CVE-2024-38790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.
Product
Smartsupp – live chat, chatbots, AI and lead generation
Affected
up to 3.6
What to do
Affects up to 3.6. Update Smartsupp – live chat, chatbots, AI and lead generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Telegram Bot & Channel: Cross-Site Request Forgery (CSRF)CVE-2024-38789 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through <= 3.8.2.
Product
Telegram Bot & Channel
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Telegram Bot & Channel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Matomo Analytics: Cross-Site Request Forgery (CSRF)CVE-2024-38766 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in matomoteam Matomo Analytics matomo allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through <= 5.1.1.
Product
Matomo Analytics
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Matomo Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Oceanic: Cross-Site Request Forgery (CSRF)CVE-2024-38765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in outtheboxthemes Oceanic oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a through <= 1.0.48.
Product
Oceanic
Affected
up to 1.0.48
What to do
Affects up to 1.0.48. Update Oceanic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Popularis Verse: Cross-Site Request Forgery (CSRF)CVE-2024-38763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through <= 1.1.1.
Product
Popularis Verse
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Popularis Verse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Event Tickets: Cross-Site Request Forgery (CSRF)CVE-2024-38762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through <= 5.11.0.4.
Product
Event Tickets
Affected
up to 5.11.0.4
What to do
Affects up to 5.11.0.4. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Taggbox: Cross-Site Request Forgery (CSRF)CVE-2024-38754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Taggbox Taggbox taggbox-widget allows Cross Site Request Forgery.This issue affects Taggbox: from n/a through <= 3.3.
Product
Taggbox
Affected
up to 3.3
What to do
Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Animated Rotating Words: Cross-Site Request Forgery (CSRF)CVE-2024-38753 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Cross Site Request Forgery.This issue affects Animated Rotating Words: from n/a through <= 5.6.
Product
Animated Rotating Words
Affected
up to 5.6
What to do
Affects up to 5.6. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Google Adsense & Banner Ads by AdsforWP: Cross-Site Request Forgery (CSRF)CVE-2024-38751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Magazine3 Google Adsense & Banner Ads by AdsforWP ads-for-wp allows Cross Site Request Forgery.This issue affects Google Adsense & Banner Ads by AdsforWP: from n/a through <= 1.9.28.
Product
Google Adsense & Banner Ads by AdsforWP
Affected
up to 1.9.28
What to do
Affects up to 1.9.28. Update Google Adsense & Banner Ads by AdsforWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025MBE eShip: Cross-Site Request Forgery (CSRF)CVE-2024-38729 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in mbeelink MBE eShip mail-boxes-etc allows Cross Site Request Forgery.This issue affects MBE eShip: from n/a through <= 2.1.2.
Product
MBE eShip
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update MBE eShip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Metorik – Reports & Email Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-38691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through <= 1.7.1.
Product
Metorik – Reports & Email Automation for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Metorik – Reports & Email Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Rara Business: Cross-Site Request Forgery (CSRF)CVE-2024-37937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Rara Business rara-business allows Cross Site Request Forgery.This issue affects Rara Business: from n/a through <= 1.2.5.
Product
Rara Business
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Rara Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Ultimate Auction: Cross-Site Request Forgery (CSRF)CVE-2024-37543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through <= 4.2.5.
Product
Ultimate Auction
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Ultimate Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Leaky Paywall: Cross-Site Request Forgery (CSRF)CVE-2024-37540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through <= 4.21.2.
Product
Leaky Paywall
Affected
up to 4.21.2
What to do
Affects up to 4.21.2. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-37518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.5.1.4.
Product
The Events Calendar
Affected
up to 6.5.1.4
What to do
Affects up to 6.5.1.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Swift Performance Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.
Product
Swift Performance Lite
Affected
up to 2.3.6.20
What to do
Affects up to 2.3.6.20. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Construction Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37508 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through <= 1.3.5.
Product
Construction Landing Page
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Lawyer Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37503 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Cross Site Request Forgery.This issue affects Lawyer Landing Page: from n/a through <= 1.2.4.
Product
Lawyer Landing Page
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Lawyer Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Posterity: Cross-Site Request Forgery (CSRF)CVE-2024-37493 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Posterity posterity allows Cross Site Request Forgery.This issue affects Posterity: from n/a through <= 3.3.
Product
Posterity
Affected
up to 3.3
What to do
Affects up to 3.3. Update Posterity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Rife Free: Cross-Site Request Forgery (CSRF)CVE-2024-37491 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apollo13themes Rife Free rife-free allows Cross Site Request Forgery.This issue affects Rife Free: from n/a through <= 2.4.18.
Product
Rife Free
Affected
up to 2.4.18
What to do
Affects up to 2.4.18. Update Rife Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Bard: Cross-Site Request Forgery (CSRF)CVE-2024-37490 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wproyal Bard bard allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 2.210.
Product
Bard
Affected
up to 2.210
What to do
Affects up to 2.210. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Ashe: Cross-Site Request Forgery (CSRF)CVE-2024-37478 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wproyal Ashe ashe allows Cross Site Request Forgery.This issue affects Ashe: from n/a through <= 2.233.
Product
Ashe
Affected
up to 2.233
What to do
Affects up to 2.233. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Trendy News: Cross-Site Request Forgery (CSRF)CVE-2024-37473 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Trendy News trendy-news allows Cross Site Request Forgery.This issue affects Trendy News: from n/a through <= 1.0.15.
Product
Trendy News
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Trendy News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Blocksy: Cross-Site Request Forgery (CSRF)CVE-2024-37469 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through <= 2.0.22.
Product
Blocksy
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Hestia: Cross-Site Request Forgery (CSRF)CVE-2024-37467 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themeisle Hestia hestia allows Cross Site Request Forgery.This issue affects Hestia: from n/a through <= 3.1.2.
Product
Hestia
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Hestia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Highlight: Cross-Site Request Forgery (CSRF)CVE-2024-37458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Highlight highlight allows Cross Site Request Forgery.This issue affects Highlight: from n/a through <= 1.0.29.
Product
Highlight
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Highlight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.