Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,768 results · page 34 of 36

Oct 3, 2023WP Mail SMTP Pro: Unauthorized access of dataCVE-2023-3213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information.
Product
WP Mail SMTP Pro
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update WP Mail SMTP Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmailsmtp.com wordfence.com
Sep 14, 2023WooCommerce CVR Payment Gateway: Unauthorized modification of dataCVE-2023-4948 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update CVR numbers for orders.
Product
WooCommerce CVR Payment Gateway
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update WooCommerce CVR Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.yanco.dk wordfence.com
Sep 12, 2023WP User Control: Unauthorized password resetsCVE-2023-4915 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.
Product
WP User Control
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update WP User Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2023wpDataTables: Does not validate the "Serialized PHP array" input data before deserializing the dataCVE-2023-4314 · WordPress plugins & themes · reported by WPScanHigh 7.2
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
Product
wpDataTables
Fixed in
2.1.66
What to do
Update wpDataTables to 2.1.66 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2023Duplicate Post Page Menu & Custom Post Type: Unauthorized page and post duplicationCVE-2023-4792 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages.
Product
Duplicate Post Page Menu & Custom Post Type
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Duplicate Post Page Menu & Custom Post Type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023WooCommerce PDF Invoice Builder: Unauthorized access of dataCVE-2023-4245 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.89
What to do
Affects up to 1.2.89. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023ProfileGrid: Unauthorized decryption of private informationCVE-2023-3404 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords.
Product
ProfileGrid
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023CHP Ads Block Detector: Unauthorized plugin settings update and resetCVE-2023-2353 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue.
Product
CHP Ads Block Detector
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update CHP Ads Block Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023BadgeOS: Unauthorized modification of dataCVE-2023-2174 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the plugin's log entries.
Product
BadgeOS
Affected
up to 3.7.1.6
What to do
Affects up to 3.7.1.6. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 30, 2023AffiliateWP: Unauthorized modification of dataCVE-2023-4600 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.
Product
AffiliateWP
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update AffiliateWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record affiliatewp.com wordfence.com
Aug 18, 2023Stripe Payment Plugin for WooCommerce: Unauthorized modification of dataCVE-2023-4040 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers to modify the order status of arbitrary WooCommerce orders.
Product
Stripe Payment Plugin for WooCommerce
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update Stripe Payment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 17, 2023Comments Like Dislike: Unauthorized modification of dataCVE-2023-3244 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: this issue is was only partially patched in version 1.2.0, as the nonce is still present to subscriber-level users.
Product
Comments Like Dislike
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Comments Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2023WP Remote Users Sync: Unauthorized access of data and addition of dataCVE-2023-4374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
Product
WP Remote Users Sync
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WP Remote Users Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 10, 2023EmbedPress: Unauthorized loss of dataCVE-2023-4282 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.
Product
EmbedPress
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2023Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on theCVE-2023-3977 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2023Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation funcCVE-2023-0958 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2023ACF Photo Gallery Field: Unauthorized modification of dataCVE-2023-3957 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.
Product
ACF Photo Gallery Field
Affected
up to 1.9
What to do
Affects up to 1.9. Update ACF Photo Gallery Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2023InstaWP Connect: Unauthorized access of data, modification of data and loss of dataCVE-2023-3956 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
Product
InstaWP Connect
Affected
up to 0.0.9.18
What to do
Affects up to 0.0.9.18. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3714 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group ownership, to update group options, including the 'associate_role' parameter, which defines the member's role. This issue was partially patched in version 5.5.2 preventing privilege escalation, however, it was fully patched in 5.5.3.
Product
ProfileGrid
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3713 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation.
Product
ProfileGrid
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023Export and Import Users and Customers: Unauthorized modification of dataCVE-2023-3459 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
Product
Export and Import Users and Customers
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3403 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.
Product
ProfileGrid
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023WP-Members Membership: Unauthorized plugin settings updateCVE-2023-2869 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
Product
WP-Members Membership
Affected
up to 3.4.7.3
What to do
Affects up to 3.4.7.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023Gallery Metabox: Unauthorized access of dataCVE-2023-2562 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.
Product
Gallery Metabox
Affected
up to 1.5
What to do
Affects up to 1.5. Update Gallery Metabox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023Gallery Metabox: Unauthorized modification of dataCVE-2023-2561 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with this plugin.
Product
Gallery Metabox
Affected
up to 1.5
What to do
Affects up to 1.5. Update Gallery Metabox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 10, 2023Buy Me a Coffee – Button and Widget: Unauthorized modification of dataCVE-2023-2078 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to update the plugins settings. CVE-2023-25030 may be a duplicate of this issue.
Product
Buy Me a Coffee – Button and Widget
Affected
up to 3.7
What to do
Affects up to 3.7. Update Buy Me a Coffee – Button and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2023Subscribe2: Unauthorized access to email functionalityCVE-2023-1844 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send emails with arbitrary content and attachments to site users.
Product
Subscribe2
Affected
up to 10.40
What to do
Affects up to 10.40. Update Subscribe2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2351 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0.
Product
WP Directory Kit
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023WP Activity Log Premium: Unauthorized modification of dataCVE-2023-2284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings.
Product
WP Activity Log Premium
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Draw Attention: Unauthorized modification of dataCVE-2023-2764 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set_featured_image function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the featured image of arbitrary posts with an image that exists in the media library.
Product
Draw Attention
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Draw Attention to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Unauthorized modification of dataCVE-2023-2557 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Unauthorized modification of dataCVE-2023-2556 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary custom drop-down currency switcher.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Unauthorized modification of dataCVE-2023-2555 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create a custom drop-down currency switcher.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2023-2414 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.6
Fixed in
4.3.2
What to do
Update Online Booking & Scheduling Calendar for WordPress by vcita to 4.3.2 or newer.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 9, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2280 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.
Product
WP Directory Kit
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023WooCommerce Multivendor Marketplace – REST API: Unauthorized access of data and addition of dataCVE-2023-2275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'get_item', 'get_order_notes' and 'add_order_note' functions in versions up to, and including, 1.5.3. This makes it possible for authenticated attackers with subscriber privileges or above, to view the order details and order notes, and add order notes.
Product
WooCommerce Multivendor Marketplace – REST API
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update WooCommerce Multivendor Marketplace – REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Elementor Addons, Widgets and Enhancements – Stax: Unauthorized modification of dataCVE-2023-2189 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_widget function in versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable Elementor widgets.
Product
Elementor Addons, Widgets and Enhancements – Stax
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Elementor Addons, Widgets and Enhancements – Stax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Essential Blocks: Unauthorized use of functionalityCVE-2023-2086 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the template_count function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin template information. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Product
Essential Blocks
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Essential Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Essential Blocks: Unauthorized use of functionalityCVE-2023-2085 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templates function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin template information. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Product
Essential Blocks
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Essential Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Essential Blocks: Unauthorized use of functionalityCVE-2023-2084 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin settings. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Product
Essential Blocks
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Essential Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Essential Blocks: Unauthorized use of functionalityCVE-2023-2083 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to save plugin settings. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Product
Essential Blocks
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Essential Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Announcement & Notification Banner – Bulletin: Unauthorized access and modification of dataCVE-2023-2066 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'bulletinwp_update_bulletin_status', 'bulletinwp_update_bulletin', 'bulletinwp_update_settings', 'bulletinwp_update_status', 'bulletinwp_export_bulletins', and 'bulletinwp_import_bulletins' functions functions in versions up to, and including, 3.6.0. This makes it possible for authenticated attackers with subscriber-level access, and above, to modify the plugin's settings, modify bulletins, create new bulletins, and more.
Product
Announcement & Notification Banner – Bulletin
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Announcement & Notification Banner – Bulletin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Getwid – Gutenberg Blocks: Unauthorized modification of dataCVE-2023-1910 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote_templates function in versions up to, and including, 1.8.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to flush the remote template cache. Cached template information can also be accessed via this endpoint but these are not considered sensitive as they are publicly accessible from the developer's site.
Product
Getwid – Gutenberg Blocks
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Getwid – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Metform Elementor Contact Form Builder: Unauthorized permalink structure updateCVE-2023-1843 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023FluentCRM - Marketing Automation For WordPress: Unauthorized modification of dataCVE-2023-1430 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.
Product
FluentCRM - Marketing Automation For WordPress
Affected
up to 2.8.01
What to do
Affects up to 2.8.01. Update FluentCRM - Marketing Automation For WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 9, 2023WP Fastest Cache: Unauthorized cache deletionCVE-2023-1375 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a missing capability check in the deleteCacheToolbar function . This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the site's cache.
Product
WP Fastest Cache
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023B2BKing: Unauthorized access of dataCVE-2023-3126 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site.
Product
B2BKing
Affected
up to 4.6.00
What to do
Affects up to 4.6.00. Update B2BKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com woocommerce-b2b-plugin.com
Jun 6, 2023B2BKing: Unauthorized modification of dataCVE-2023-3125 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_price_import' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to modify the pricing of any product on the site.
Product
B2BKing
Affected
up to 4.6.00
What to do
Affects up to 4.6.00. Update B2BKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com woocommerce-b2b-plugin.com
Jun 6, 2023Elementor Pro: Unauthorized data modificationCVE-2023-3124 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.
Product
Elementor Pro
Affected
up to 3.11.6
What to do
Affects up to 3.11.6. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2023-2415 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.2.10
What to do
Affects up to 4.2.10. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.