Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

3,631 results · page 33 of 73

Nov 14, 2024W3P SEO: Cross-Site Request Forgery (CSRF)CVE-2024-51684 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through < 1.8.6.
Product
W3P SEO
What to do
Update W3P SEO to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024FraudLabs Pro SMS Verification: Cross-Site Request Forgery (CSRF)CVE-2024-51688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through <= 1.10.1.
Product
FraudLabs Pro SMS Verification
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update FraudLabs Pro SMS Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Featured Posts Scroll: Cross-Site Request Forgery (CSRF)CVE-2024-51647 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through 1.25.
Product
Featured Posts Scroll
Affected
up to 1.25
What to do
Affects up to 1.25. Update Featured Posts Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Responsive Flickr Gallery: Cross-Site Request Forgery (CSRF)CVE-2024-51630 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Lars Schenk Responsive Flickr Gallery responsive-flickr-gallery allows Stored XSS.This issue affects Responsive Flickr Gallery: from n/a through <= 1.3.1.
Product
Responsive Flickr Gallery
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Responsive Flickr Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 5, 2024Post From Frontend: Does not have CSRF checkCVE-2024-9689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack
Product
Post From Frontend
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Post From Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 1, 2024Depicter Slider: Cross-Site Request Forgery (CSRF)CVE-2024-47359 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2.
Product
Depicter Slider
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024Custom Twitter Feeds (Tweets Widget): Cross-Site Request Forgery (CSRF)CVE-2024-49685 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through <= 2.2.3.
Product
Custom Twitter Feeds (Tweets Widget)
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Custom Twitter Feeds (Tweets Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024EKC Tournament Manager: Cross-Site Request Forgery (CSRF)CVE-2024-49674 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through <= 2.2.1.
Product
EKC Tournament Manager
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update EKC Tournament Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024Podlove Podcast Publisher: Cross-Site Request Forgery (CSRF)CVE-2024-43984 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
Product
Podlove Podcast Publisher
Affected
up to 4.1.13
What to do
Affects up to 4.1.13. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024JobSearch: Cross-Site Request Forgery (CSRF)CVE-2024-43930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in eyecix JobSearch allows Cross Site Request Forgery.This issue affects JobSearch: from n/a through 2.5.3.
Product
JobSearch
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024DarkMySite – Advanced Dark Mode Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-50466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite – Advanced Dark Mode Plugin for WordPress: from n/a through 1.2.8.
Product
DarkMySite – Advanced Dark Mode Plugin for
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update DarkMySite – Advanced Dark Mode Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Google Docs RSVP: Cross-Site Request Forgery (CSRF)CVE-2024-49672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through <= 2.0.1.
Product
Google Docs RSVP
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Google Docs RSVP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2024LatePoint: Cross-Site Request Forgery (CSRF)CVE-2024-43945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.
Product
LatePoint
Affected
up to 4.9.91
What to do
Affects up to 4.9.91. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Most And Least Read Posts Widget: Cross-Site Request Forgery (CSRF)CVE-2024-49628 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Cross Site Request Forgery.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.18.
Product
Most And Least Read Posts Widget
Affected
up to 2.5.18
What to do
Affects up to 2.5.18. Update Most And Least Read Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WordPress Image SEO: Cross-Site Request Forgery (CSRF)CVE-2024-49627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from n/a through 1.1.4.
Product
WordPress Image SEO
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WordPress Image SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WP Content Copy Protection & No Right Click: Cross-Site Request Forgery (CSRF)CVE-2024-49306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.
Product
WP Content Copy Protection & No Right Click
Affected
up to 3.5.9
What to do
Affects up to 3.5.9. Update WP Content Copy Protection & No Right Click to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Cooked Pro: Cross-Site Request Forgery (CSRF)CVE-2024-49290 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.
Product
Cooked Pro
Fixed in
1.8.0
What to do
Update Cooked Pro to 1.8.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024IdeaPush: Cross-Site Request Forgery (CSRF)CVE-2024-49275 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Site Request Forgery.This issue affects IdeaPush: from n/a through <= 8.69.
Product
IdeaPush
Affected
up to 8.69
What to do
Affects up to 8.69. Update IdeaPush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024VOD Infomaniak: Cross-Site Request Forgery (CSRF)CVE-2024-49274 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.
Product
VOD Infomaniak
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Social Auto Poster: Cross-Site Request Forgery (CSRF)CVE-2024-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through <= 5.3.15.
Product
Social Auto Poster
Affected
up to 5.3.15
What to do
Affects up to 5.3.15. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Table of Contents Plus: Cross-Site Request Forgery (CSRF)CVE-2024-49250 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through <= 2408.
Product
Table of Contents Plus
Affected
up to 2408
What to do
Affects up to 2408. Update Table of Contents Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024CartBounty – Save and recover abandoned carts for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-47634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through <= 8.2.
Product
CartBounty – Save and recover abandoned carts for WooCommerce
Affected
up to 8.2
What to do
Affects up to 8.2. Update CartBounty – Save and recover abandoned carts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Endless Posts Navigation: Cross-Site Request Forgery (CSRF)CVE-2024-49629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.
Product
Endless Posts Navigation
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Endless Posts Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Back Link Tracker: Cross-Site Request Forgery (CSRF)CVE-2024-49617 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.
Product
Back Link Tracker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Back Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024SafetyForms: Cross-Site Request Forgery (CSRF)CVE-2024-49615 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0.
Product
SafetyForms
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update SafetyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024AVChat Video Chat: Cross-Site Request Forgery (CSRF)CVE-2024-49605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.
Product
AVChat Video Chat
Affected
up to 2.2
What to do
Affects up to 2.2. Update AVChat Video Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024GoogleDrive folder list: Cross-Site Request Forgery (CSRF)CVE-2024-49335 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.
Product
GoogleDrive folder list
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update GoogleDrive folder list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Apa Banner Slider: Cross-Site Request Forgery (CSRF)CVE-2024-49622 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.
Product
Apa Banner Slider
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Apa Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024APA Register Newsletter Form: Cross-Site Request Forgery (CSRF)CVE-2024-49621 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.
Product
APA Register Newsletter Form
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update APA Register Newsletter Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024VKontakte Wall Post: Cross-Site Request Forgery (CSRF)CVE-2024-49313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: from n/a through <= 2.0.
Product
VKontakte Wall Post
Affected
up to 2.0
What to do
Affects up to 2.0. Update VKontakte Wall Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Pinpoint Booking System: Cross-Site Request Forgery (CSRF)CVE-2024-49304 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.
Product
Pinpoint Booking System
Affected
up to 2.9.9.5.7
What to do
Affects up to 2.9.9.5.7. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Ahmeti Wp Timeline: Cross-Site Request Forgery (CSRF)CVE-2024-49237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through <= 5.1.
Product
Ahmeti Wp Timeline
Affected
up to 5.1
What to do
Affects up to 5.1. Update Ahmeti Wp Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024CJ Change Howdy: Cross-Site Request Forgery (CSRF)CVE-2024-49223 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change Howdy: from n/a through <= 3.3.1.
Product
CJ Change Howdy
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update CJ Change Howdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024cSlider: Cross-Site Request Forgery (CSRF)CVE-2024-49221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.
Product
cSlider
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update cSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Cookie Scanner: Cross-Site Request Forgery (CSRF)CVE-2024-49220 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: from n/a through <= 1.1.
Product
Cookie Scanner
Affected
up to 1.1
What to do
Affects up to 1.1. Update Cookie Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Wsify Widget: Cross-Site Request Forgery (CSRF)CVE-2024-48048 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.
Product
Wsify Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update Wsify Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2024-48037 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.2.
Product
Contact Form Widget
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Featured Posts with Multiple Custom Groups (FPMCG): Cross-Site Request Forgery (CSRF)CVE-2024-48031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpmcg allows Cross Site Request Forgery.This issue affects Featured Posts with Multiple Custom Groups (FPMCG): from n/a through <= 4.0.
Product
Featured Posts with Multiple Custom Groups (FPMCG)
Affected
up to 4.0
What to do
Affects up to 4.0. Update Featured Posts with Multiple Custom Groups (FPMCG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Linked Variation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-48047 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through <= 1.0.5.
Product
Linked Variation for WooCommerce
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Linked Variation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024wp-Monalisa: Cross-Site Request Forgery (CSRF)CVE-2024-48038 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4.
Product
wp-Monalisa
Affected
up to 6.4
What to do
Affects up to 6.4. Update wp-Monalisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024NiceJob: Cross-Site Request Forgery (CSRF)CVE-2024-44028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.
Product
NiceJob
What to do
Update NiceJob to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024TinyPNG: Cross-Site Request Forgery (CSRF)CVE-2024-47635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TinyPNG TinyPNG tiny-compress-images allows Cross Site Request Forgery.This issue affects TinyPNG: from n/a through <= 3.4.3.
Product
TinyPNG
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update TinyPNG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2024GiveWP: Cross-Site Request Forgery (CSRF)CVE-2024-47315 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1.
Product
GiveWP
Affected
up to 3.15.1
What to do
Affects up to 3.15.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2024Use Any Font: Cross-Site Request Forgery (CSRF)CVE-2024-47305 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font use-any-font allows Cross Site Request Forgery.This issue affects Use Any Font: from n/a through <= 6.3.08.
Product
Use Any Font
Affected
up to 6.3.08
What to do
Affects up to 6.3.08. Update Use Any Font to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2024adstxt: Does not have CSRF check in placeCVE-2024-7892 · WordPress plugins & themes · reported by WPScanMedium 4.3
The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
adstxt
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update adstxt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2024Posts reminder: Does not have CSRF check in placeCVE-2024-8093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Posts reminder
Affected
up to 0.20
What to do
Affects up to 0.20. Update Posts reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2024Accordion Image Menu: Does not have CSRF check in some placesCVE-2024-8092 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Accordion Image Menu
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Accordion Image Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2024Enhanced Search Box: Does not have CSRF check in placeCVE-2024-8091 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Enhanced Search Box
Affected
up to 0.6.1
What to do
Affects up to 0.6.1. Update Enhanced Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2024Review Ratings: Does not have CSRF check in some placesCVE-2024-8052 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Review Ratings
Affected
up to 1.6
What to do
Affects up to 1.6. Update Review Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2024Special Feed Items: Does not have CSRF check in some placesCVE-2024-8051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Special Feed Items
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Special Feed Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.