Vulnerability database

3,631 results · page 29 of 73

• Jan 2, 2025Travel Agency: Cross-Site Request Forgery (CSRF)CVE-2024-37451 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Travel Agency travel-agency allows Cross Site Request Forgery.This issue affects Travel Agency: from n/a through <= 1.4.9.

  Product

  Travel Agency

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update Travel Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Benevolent: Cross-Site Request Forgery (CSRF)CVE-2024-37450 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Benevolent benevolent allows Cross Site Request Forgery.This issue affects Benevolent: from n/a through <= 1.3.4.

  Product

  Benevolent

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Benevolent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025OnePress: Cross-Site Request Forgery (CSRF)CVE-2024-37448 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in famethemes OnePress onepress allows Cross Site Request Forgery.This issue affects OnePress: from n/a through <= 2.3.6.

  Product

  OnePress

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update OnePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025NewsMash: Cross-Site Request Forgery (CSRF)CVE-2024-37441 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in desertthemes NewsMash newsmash allows Cross Site Request Forgery.This issue affects NewsMash: from n/a through <= 1.0.34.

  Product

  NewsMash

  Affected

  up to 1.0.34

  What to do

  Affects up to 1.0.34. Update NewsMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Perfect Portfolio: Cross-Site Request Forgery (CSRF)CVE-2024-37435 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Cross Site Request Forgery.This issue affects Perfect Portfolio: from n/a through <= 1.2.0.

  Product

  Perfect Portfolio

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Mesmerize: Cross-Site Request Forgery (CSRF)CVE-2024-37431 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Mesmerize mesmerize allows Cross Site Request Forgery.This issue affects Mesmerize: from n/a through <= 1.6.120.

  Product

  Mesmerize

  Affected

  up to 1.6.120

  What to do

  Affects up to 1.6.120. Update Mesmerize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Elegant Pink: Cross-Site Request Forgery (CSRF)CVE-2024-37426 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Elegant Pink elegant-pink allows Cross Site Request Forgery.This issue affects Elegant Pink: from n/a through <= 1.3.0.

  Product

  Elegant Pink

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025JobScout: Cross-Site Request Forgery (CSRF)CVE-2024-37421 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme JobScout jobscout allows Cross Site Request Forgery.This issue affects JobScout: from n/a through <= 1.1.4.

  Product

  JobScout

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update JobScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Coachify: Cross-Site Request Forgery (CSRF)CVE-2024-37417 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.0.7.

  Product

  Coachify

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Coachify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Preschool and Kindergarten: Cross-Site Request Forgery (CSRF)CVE-2024-37413 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Cross Site Request Forgery.This issue affects Preschool and Kindergarten: from n/a through <= 1.2.1.

  Product

  Preschool and Kindergarten

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Preschool and Kindergarten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Blossom Shop: Cross-Site Request Forgery (CSRF)CVE-2024-37412 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.

  Product

  Blossom Shop

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Blossom Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WP Mobile Menu: Cross-Site Request Forgery (CSRF)CVE-2024-37274 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Rui Guerreiro WP Mobile Menu mobile-menu allows Cross Site Request Forgery.This issue affects WP Mobile Menu: from n/a through <= 2.8.4.3.

  Product

  WP Mobile Menu

  Affected

  up to 2.8.4.3

  What to do

  Affects up to 2.8.4.3. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Travel Monster: Cross-Site Request Forgery (CSRF)CVE-2024-37272 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.

  Product

  Travel Monster

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Travel Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Vandana Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37243 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vandana Lite vandana-lite allows Cross Site Request Forgery.This issue affects Vandana Lite: from n/a through <= 1.1.9.

  Product

  Vandana Lite

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Vandana Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Newspack Newsletters: Cross-Site Request Forgery (CSRF)CVE-2024-37242 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through <= 2.13.2.

  Product

  Newspack Newsletters

  Affected

  up to 2.13.2

  What to do

  Affects up to 2.13.2. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Falang multilanguage: Cross-Site Request Forgery (CSRF)CVE-2024-37240 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.51.

  Product

  Falang multilanguage

  Affected

  up to 1.3.51

  What to do

  Affects up to 1.3.51. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WPAdverts: Cross-Site Request Forgery (CSRF)CVE-2024-37238 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Greg Winiarski WPAdverts wpadverts allows Cross Site Request Forgery.This issue affects WPAdverts: from n/a through <= 2.1.2.

  Product

  WPAdverts

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Loco Translate: Cross-Site Request Forgery (CSRF)CVE-2024-37236 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Tim W Loco Translate loco-translate allows Cross Site Request Forgery.This issue affects Loco Translate: from n/a through <= 2.6.9.

  Product

  Loco Translate

  Affected

  up to 2.6.9

  What to do

  Affects up to 2.6.9. Update Loco Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Groundhogg: Cross-Site Request Forgery (CSRF)CVE-2024-37235 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Adrian Tobey Groundhogg groundhogg allows Cross Site Request Forgery.This issue affects Groundhogg: from n/a through <= 3.4.2.3.

  Product

  Groundhogg

  Affected

  up to 3.4.2.3

  What to do

  Affects up to 3.4.2.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Chic Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37104 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Chic Lite chic-lite allows Cross Site Request Forgery.This issue affects Chic Lite: from n/a through <= 1.1.3.

  Product

  Chic Lite

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Chic Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Education Zone: Cross-Site Request Forgery (CSRF)CVE-2024-37103 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Education Zone education-zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through <= 1.3.4.

  Product

  Education Zone

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Education Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Vilva: Cross-Site Request Forgery (CSRF)CVE-2024-37102 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vilva vilva allows Cross Site Request Forgery.This issue affects Vilva: from n/a through <= 1.2.2.

  Product

  Vilva

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Vilva to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025MasterStudy LMS: Cross-Site Request Forgery (CSRF)CVE-2024-37093 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.

  Product

  MasterStudy LMS

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024EditionGuard for WooCommerce – eBook Sales with DRM: Cross-Site Request Forgery (CSRF)CVE-2024-56207 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Privilege Escalation.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.

  Product

  EditionGuard for WooCommerce – eBook Sales with DRM

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024gap-hub-user-role: Cross-Site Request Forgery (CSRF)CVE-2024-56206 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through <= 3.4.1.

  Product

  gap-hub-user-role

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update gap-hub-user-role to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Sinking Dropdowns: Cross-Site Request Forgery (CSRF)CVE-2024-56204 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through <= 1.25.

  Product

  Sinking Dropdowns

  Affected

  up to 1.25

  What to do

  Affects up to 1.25. Update Sinking Dropdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Wayne Audio Player: Cross-Site Request Forgery (CSRF)CVE-2024-56203 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Player: from n/a through <= 1.0.

  Product

  Wayne Audio Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Wayne Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024WP Nice Loader: Cross-Site Request Forgery (CSRF)CVE-2024-56232 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a through <= 0.1.0.4.

  Product

  WP Nice Loader

  Affected

  up to 0.1.0.4

  What to do

  Affects up to 0.1.0.4. Update WP Nice Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024SearchIQ: Cross-Site Request Forgery (CSRF)CVE-2024-56229 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in SearchIQ SearchIQ searchiq.This issue affects SearchIQ: from n/a through <= 4.6.

  Product

  SearchIQ

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024CodeBard Help Desk: Cross-Site Request Forgery (CSRF)CVE-2024-56222 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Cross Site Request Forgery.This issue affects CodeBard Help Desk: from n/a through <= 1.1.1.

  Product

  CodeBard Help Desk

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Contact Form 7 – Dynamic Text Extension: Cross-Site Request Forgery (CSRF)CVE-2024-56218 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site Request Forgery.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through <= 5.0.1.

  Product

  Contact Form 7 – Dynamic Text Extension

  Affected

  up to 5.0.1

  What to do

  Affects up to 5.0.1. Update Contact Form 7 – Dynamic Text Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 27, 2024DN Shipping by Weight for WooCommerce: Does not have CSRF check in placeCVE-2024-11842 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  Product

  DN Shipping by Weight for WooCommerce

  Fixed in

  1.2

  What to do

  Update DN Shipping by Weight for WooCommerce to 1.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Dec 21, 2024GTPayment Donations: Does not have CSRF check in some placesCVE-2024-11607 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

  Product

  GTPayment Donations

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update GTPayment Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Dec 18, 2024Cost Calculator Builder: Does not have CSRF checks in some AJAX actionsCVE-2024-10892 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

  Product

  Cost Calculator Builder

  Fixed in

  3.2.43

  What to do

  Update Cost Calculator Builder to 3.2.43 or newer.

  Full record and what to do →NVD recordwpscan.com

• Dec 16, 2024Stop Registration Spam: Cross-Site Request Forgery (CSRF)CVE-2024-56017 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23.

  Product

  Stop Registration Spam

  Affected

  up to 1.23

  What to do

  Affects up to 1.23. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Avada: Cross-Site Request Forgery (CSRF)CVE-2024-54357 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.

  Product

  Avada

  Affected

  up to 7.11.10

  What to do

  Affects up to 7.11.10. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Tidy Up: Cross-Site Request Forgery (CSRF)CVE-2024-56015 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3.

  Product

  Tidy Up

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Tidy Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Flash News / Post (Responsive): Cross-Site Request Forgery (CSRF)CVE-2024-56012 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.

  Product

  Flash News / Post (Responsive)

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Flash News / Post (Responsive) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Posti Shipping: Cross-Site Request Forgery (CSRF)CVE-2024-56005 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: from n/a through <= 3.10.3.

  Product

  Posti Shipping

  Affected

  up to 3.10.3

  What to do

  Affects up to 3.10.3. Update Posti Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP-Ban-User: Cross-Site Request Forgery (CSRF)CVE-2024-54440 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0.

  Product

  WP-Ban-User

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP-Ban-User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Amazon Product Price: Cross-Site Request Forgery (CSRF)CVE-2024-54439 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.

  Product

  Amazon Product Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Amazon Product Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Gaxx Keywords: Cross-Site Request Forgery (CSRF)CVE-2024-54438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through <= 0.2.

  Product

  Gaxx Keywords

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Gaxx Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Jet Footer Code: Cross-Site Request Forgery (CSRF)CVE-2024-54436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a through <= 1.4.

  Product

  Jet Footer Code

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Jet Footer Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Onlywire Multi Autosubmitter: Cross-Site Request Forgery (CSRF)CVE-2024-54435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through <= 1.2.4.

  Product

  Onlywire Multi Autosubmitter

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Onlywire Multi Autosubmitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024phZoom: Cross-Site Request Forgery (CSRF)CVE-2024-54434 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.

  Product

  phZoom

  Affected

  up to 1.2.92

  What to do

  Affects up to 1.2.92. Update phZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Simple Booking Widget: Cross-Site Request Forgery (CSRF)CVE-2024-54433 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through <= 1.1.

  Product

  Simple Booking Widget

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple Booking Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Flipkart Importer: Cross-Site Request Forgery (CSRF)CVE-2024-54432 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik WP Flipkart Importer wp-flipkart-importer allows Stored XSS.This issue affects WP Flipkart Importer: from n/a through <= 1.4.

  Product

  WP Flipkart Importer

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WP Flipkart Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Admin Customization: Cross-Site Request Forgery (CSRF)CVE-2024-54431 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in phpdevp Admin Customization wpp-customization allows Stored XSS.This issue affects Admin Customization: from n/a through <= 2.2.

  Product

  Admin Customization

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Admin Customization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024EELV Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-54430 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.

  Product

  EELV Newsletter

  Affected

  up to 4.8.2

  What to do

  Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Aphorismus: Cross-Site Request Forgery (CSRF)CVE-2024-54429 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through <= 1.2.0.

  Product

  Aphorismus

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Aphorismus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.