Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

3,631 results · page 32 of 73

Nov 28, 2024Custom Shortcode Sidebars: Cross-Site Request Forgery (CSRF)CVE-2024-53736 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jason Grim Custom Shortcode Sidebars custom-shortcode-sidebars allows Stored XSS.This issue affects Custom Shortcode Sidebars: from n/a through <= 1.2.
Product
Custom Shortcode Sidebars
Affected
up to 1.2
What to do
Affects up to 1.2. Update Custom Shortcode Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Idealien Category Enhancements: Cross-Site Request Forgery (CSRF)CVE-2024-53734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jamie O Idealien Category Enhancements idealien-category-enhancements allows Stored XSS.This issue affects Idealien Category Enhancements: from n/a through <= 1.2.
Product
Idealien Category Enhancements
Affected
up to 1.2
What to do
Affects up to 1.2. Update Idealien Category Enhancements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Footer Flyout Widget: Cross-Site Request Forgery (CSRF)CVE-2024-53732 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpwox Footer Flyout Widget footer-flyout-widget allows Stored XSS.This issue affects Footer Flyout Widget: from n/a through <= 1.1.
Product
Footer Flyout Widget
Affected
up to 1.1
What to do
Affects up to 1.1. Update Footer Flyout Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2024Alphabetical List: Does not have CSRF check in placeCVE-2024-8157 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Alphabetical List
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Alphabetical List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 21, 2024CM Table Of Contents: Does not have CSRF checkCVE-2024-5029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
CM Table Of Contents
Fixed in
1.2.4
What to do
Update CM Table Of Contents to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 20, 2024Post Ideas: Cross-Site Request Forgery (CSRF)CVE-2024-52451 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aaronrobbins Post Ideas post-ideas allows SQL Injection.This issue affects Post Ideas: from n/a through <= 2.
Product
Post Ideas
Affected
up to 2
What to do
Affects up to 2. Update Post Ideas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 20, 2024Buying Buddy IDX CRM: Cross-Site Request Forgery (CSRF)CVE-2024-52446 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through <= 1.2.8.
Product
Buying Buddy IDX CRM
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024W3SPEEDSTER: Cross-Site Request Forgery (CSRF)CVE-2024-52392 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp.This issue affects W3SPEEDSTER: from n/a through <= 7.25.
Product
W3SPEEDSTER
Affected
up to 7.25
What to do
Affects up to 7.25. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Dynamic Widgets: Cross-Site Request Forgery (CSRF)CVE-2024-51669 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through <= 1.6.4.
Product
Dynamic Widgets
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024ARMember: Cross-Site Request Forgery (CSRF)CVE-2022-47424 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.
Product
ARMember
Affected
up to 4.0.5
Fixed in
6.7.1
What to do
Update ARMember to 6.7.1 or newer.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024WP Popup Window Maker: Cross-Site Request Forgery (CSRF)CVE-2024-52421 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through <= 2.0.
Product
WP Popup Window Maker
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Popup Window Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Disable Admin Notices individually: Cross-Site Request Forgery (CSRF)CVE-2024-52420 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.
Product
Disable Admin Notices individually
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Disable Admin Notices individually to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Exclusive Content Password Protect: Cross-Site Request Forgery (CSRF)CVE-2024-52402 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in gunghoinc Exclusive Content Password Protect exclusive-content-password-protect allows Upload a Web Shell to a Web Server.This issue affects Exclusive Content Password Protect: from n/a through <= 1.1.0.
Product
Exclusive Content Password Protect
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Exclusive Content Password Protect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Hacklog DownloadManager: Cross-Site Request Forgery (CSRF)CVE-2024-52401 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through <= 2.1.4.
Product
Hacklog DownloadManager
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Hacklog DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Hebrew Date: Cross-Site Request Forgery (CSRF)CVE-2024-52388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mikeage Hebrew Date hebrewdates allows Stored XSS.This issue affects Hebrew Date: from n/a through <= 2.1.0.
Product
Hebrew Date
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Hebrew Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Manage User Columns: Cross-Site Request Forgery (CSRF)CVE-2024-51686 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Deepak Khokhar Manage User Columns manage-user-columns allows Cross Site Request Forgery.This issue affects Manage User Columns: from n/a through <= 1.0.5.
Product
Manage User Columns
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Manage User Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024SmartLink Dynamic URLs: Cross-Site Request Forgery (CSRF)CVE-2024-51657 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through <= 1.1.0.
Product
SmartLink Dynamic URLs
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update SmartLink Dynamic URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Flash Show And Hide Box: Cross-Site Request Forgery (CSRF)CVE-2024-51656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in litefeel Flash Show And Hide Box flash-show-and-hide-box allows Stored XSS.This issue affects Flash Show And Hide Box: from n/a through <= 1.6.
Product
Flash Show And Hide Box
Affected
up to 1.6
What to do
Affects up to 1.6. Update Flash Show And Hide Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Custom Author URL: Cross-Site Request Forgery (CSRF)CVE-2024-51655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in microkid Custom Author URL author-slug allows Stored XSS.This issue affects Custom Author URL: from n/a through <= 2.0.1.
Product
Custom Author URL
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Custom Author URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024APK Downloader: Cross-Site Request Forgery (CSRF)CVE-2024-51654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Eric Allen APK Downloader apk-downloader allows Stored XSS.This issue affects APK Downloader: from n/a through <= 1.0.0.
Product
APK Downloader
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update APK Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024UPDATE NOTIFICATIONS: Cross-Site Request Forgery (CSRF)CVE-2024-51653 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in akira1891 UPDATE NOTIFICATIONS update-notifications allows Stored XSS.This issue affects UPDATE NOTIFICATIONS: from n/a through <= 0.3.4.
Product
UPDATE NOTIFICATIONS
Affected
up to 0.3.4
What to do
Affects up to 0.3.4. Update UPDATE NOTIFICATIONS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Skip To: Cross-Site Request Forgery (CSRF)CVE-2024-51652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in marckocher Skip To skip-to allows Stored XSS.This issue affects Skip To: from n/a through <= 2.0.0.
Product
Skip To
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Skip To to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Random Featured Post: Cross-Site Request Forgery (CSRF)CVE-2024-51650 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scottmydollarplancom Random Featured Post random-featured-post-plugin allows Stored XSS.This issue affects Random Featured Post: from n/a through <= 1.1.3.
Product
Random Featured Post
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Random Featured Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Mobilize: Cross-Site Request Forgery (CSRF)CVE-2024-51649 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Patrick Lumumba Mobilize mobilize allows Stored XSS.This issue affects Mobilize: from n/a through <= 3.0.7.
Product
Mobilize
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Mobilize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024e-shops: Cross-Site Request Forgery (CSRF)CVE-2024-51648 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hands01 e-shops e-shops-cart2 allows Reflected XSS.This issue affects e-shops: from n/a through <= 1.0.3.
Product
e-shops
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update e-shops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024ThemeFuse Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2024-51645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in themefusecom ThemeFuse Maintenance Mode themefuse-maintenance-mode allows Stored XSS.This issue affects ThemeFuse Maintenance Mode: from n/a through <= 1.1.3.
Product
ThemeFuse Maintenance Mode
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update ThemeFuse Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Addressbook: Cross-Site Request Forgery (CSRF)CVE-2024-51644 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in samwilson Addressbook addressbook allows Stored XSS.This issue affects Addressbook: from n/a through <= 1.1.3.
Product
Addressbook
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Addressbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Amazon Associate Filter: Cross-Site Request Forgery (CSRF)CVE-2024-51643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ragaskar Amazon Associate Filter amazon-associate-filter allows Stored XSS.This issue affects Amazon Associate Filter: from n/a through <= 0.4.
Product
Amazon Associate Filter
Affected
up to 0.4
What to do
Affects up to 0.4. Update Amazon Associate Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Seo Free: Cross-Site Request Forgery (CSRF)CVE-2024-51642 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ivan9146 Seo Free seo-free allows Stored XSS.This issue affects Seo Free: from n/a through <= 1.4.
Product
Seo Free
Affected
up to 1.4
What to do
Affects up to 1.4. Update Seo Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Advanced PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2024-51641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Juan Camilo Advanced PDF Generator advanced-pdf-generator allows Stored XSS.This issue affects Advanced PDF Generator: from n/a through <= 0.4.0.
Product
Advanced PDF Generator
Affected
up to 0.4.0
What to do
Affects up to 0.4.0. Update Advanced PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024MDR Webmaster Tools: Cross-Site Request Forgery (CSRF)CVE-2024-51640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through <= 1.1.
Product
MDR Webmaster Tools
Affected
up to 1.1
What to do
Affects up to 1.1. Update MDR Webmaster Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Naver Blog: Cross-Site Request Forgery (CSRF)CVE-2024-51639 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Hints Naver Blog naver-blog-api allows Stored XSS.This issue affects Naver Blog: from n/a through <= 1.0.
Product
Naver Blog
Affected
up to 1.0
What to do
Affects up to 1.0. Update Naver Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Shortcodes For Genesis: Cross-Site Request Forgery (CSRF)CVE-2024-51638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Awesome Shortcodes For Genesis awesome-shortcodes-for-genesis allows Stored XSS.This issue affects Awesome Shortcodes For Genesis: from n/a through 1.1.8.
Product
Awesome Shortcodes For Genesis
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Awesome Shortcodes For Genesis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Admin SMS Alert: Cross-Site Request Forgery (CSRF)CVE-2024-51637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sroyalty Admin SMS Alert admin-sms-alert allows Stored XSS.This issue affects Admin SMS Alert: from n/a through <= 1.1.0.
Product
Admin SMS Alert
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Admin SMS Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024GMO Social Connection: Cross-Site Request Forgery (CSRF)CVE-2024-51636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Z.com byGMO GMO Social Connection gmo-social-connection allows Cross-Site Scripting (XSS).This issue affects GMO Social Connection: from n/a through <= 1.2.
Product
GMO Social Connection
Affected
up to 1.2
What to do
Affects up to 1.2. Update GMO Social Connection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024While Loading: Cross-Site Request Forgery (CSRF)CVE-2024-51635 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Garmur While Loading while-it-is-loading allows Stored XSS.This issue affects While Loading: from n/a through <= 3.0.
Product
While Loading
Affected
up to 3.0
What to do
Affects up to 3.0. Update While Loading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Webriti Custom Login: Cross-Site Request Forgery (CSRF)CVE-2024-51634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Webriti Custom Login webriti-custom-login-page allows Reflected XSS.This issue affects Webriti Custom Login: from n/a through <= 0.3.
Product
Webriti Custom Login
Affected
up to 0.3
What to do
Affects up to 0.3. Update Webriti Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Simple Page Specific Sidebars: Cross-Site Request Forgery (CSRF)CVE-2024-51633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ivycat Simple Page Specific Sidebars page-specific-sidebars allows Stored XSS.This issue affects Simple Page Specific Sidebars: from n/a through <= 2.14.1.
Product
Simple Page Specific Sidebars
Affected
up to 2.14.1
What to do
Affects up to 2.14.1. Update Simple Page Specific Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024SH Slideshow: Cross-Site Request Forgery (CSRF)CVE-2024-51632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sam Hoe SH Slideshow sh-slideshow allows Stored XSS.This issue affects SH Slideshow: from n/a through <= 4.3.
Product
SH Slideshow
Affected
up to 4.3
What to do
Affects up to 4.3. Update SH Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Sticky Social Bar: Cross-Site Request Forgery (CSRF)CVE-2024-51631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Md Eftakhairul Islam Sticky Social Bar sticky-social-bar allows Cross Site Request Forgery.This issue affects Sticky Social Bar: from n/a through <= 2.0.
Product
Sticky Social Bar
Affected
up to 2.0
What to do
Affects up to 2.0. Update Sticky Social Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024World Prayer Time: Cross-Site Request Forgery (CSRF)CVE-2024-50534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in techdabang World Prayer Time world-prayer-time allows Stored XSS.This issue affects World Prayer Time: from n/a through <= 2.0.
Product
World Prayer Time
Affected
up to 2.0
What to do
Affects up to 2.0. Update World Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Domain Sharding: Cross-Site Request Forgery (CSRF)CVE-2024-50533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in David Garcia Domain Sharding domain-sharding allows Stored XSS.This issue affects Domain Sharding: from n/a through <= 1.2.1.
Product
Domain Sharding
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Domain Sharding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
Product
Crowdsignal Dashboard – Polls, Surveys & more
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024wp-login customizer: Cross-Site Request Forgery (CSRF)CVE-2024-52424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through <= 1.0.
Product
wp-login customizer
Affected
up to 1.0
What to do
Affects up to 1.0. Update wp-login customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024CM Table Of Contents: Does not have CSRF check in placeCVE-2024-5030 · WordPress plugins & themes · reported by WPScanLow 3.8
The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Product
CM Table Of Contents
Fixed in
1.2.3
What to do
Update CM Table Of Contents to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 16, 2024SK WP Settings Backup: Cross-Site Request Forgery (CSRF)CVE-2024-52415 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in skipstorm SK WP Settings Backup sk-wp-settings-backup allows Object Injection.This issue affects SK WP Settings Backup: from n/a through <= 1.0.
Product
SK WP Settings Backup
Affected
up to 1.0
What to do
Affects up to 1.0. Update SK WP Settings Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Appointmind: Cross-Site Request Forgery (CSRF)CVE-2024-51679 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue affects Appointmind: from n/a through <= 4.0.0.
Product
Appointmind
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Appointmind to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Twitter @Anywhere Plus: Cross-Site Request Forgery (CSRF)CVE-2024-51659 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus twitter-anywhere-plus allows Stored XSS.This issue affects Twitter @Anywhere Plus: from n/a through <= 2.0.
Product
Twitter @Anywhere Plus
Affected
up to 2.0
What to do
Affects up to 2.0. Update Twitter @Anywhere Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024WP Course Manager: Cross-Site Request Forgery (CSRF)CVE-2024-51658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through <= 1.3.
Product
WP Course Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Course Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Platform.ly Official: Cross-Site Request Forgery (CSRF)CVE-2024-51687 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Platform.ly Platform.ly Official platformly allows Stored XSS.This issue affects Platform.ly Official: from n/a through <= 1.1.3.
Product
Platform.ly Official
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Platform.ly Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.