Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,631 results · page 35 of 73
Aug 5, 2024The lacks CSRF checks allowing a user to invite any user to any group (including private groups)CVE-2024-2232 · WordPress plugins & themes · reported by WPScanHigh 8.1
The lacks CSRF checks allowing a user to invite any user to any group (including private groups)
- Fixed in
- 2.1.3
- What to do
- Update the plugin to 2.1.3 or newer.
Aug 2, 2024WP GoToWebinar: Cross-Site Request Forgery (CSRF)CVE-2024-38776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a through 15.7.
- Product
- WP GoToWebinar
- Affected
- up to 15.7
- What to do
- Affects up to 15.7. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Light Poll: Does not have CSRF checksCVE-2024-6496 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such action via a CSRF attack
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some bulk actionsCVE-2024-3983 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some placesCVE-2024-2843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.2
- What to do
- Update WooCommerce Customers Manager to 30.2 or newer.
Jul 31, 2024HTML Forms: Does not have CSRF checks in some placesCVE-2024-6412 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- HTML Forms
- Fixed in
- 1.3.34
- What to do
- Update HTML Forms to 1.3.34 or newer.
Jul 30, 2024پلاگین پرداخت دلخواه: Does not have CSRF check in placeCVE-2024-6230 · WordPress plugins & themes · reported by WPScanMedium 6.5
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- پلاگین پرداخت دلخواه
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update پلاگین پرداخت دلخواه to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not have CSRF check in some placesCVE-2024-6224 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not have CSRF check in placeCVE-2024-5808 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5285 · WordPress plugins & themes · reported by WPScanMedium 5.5
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.2
- What to do
- Update wp-affiliate-platform to 6.5.2 or newer.
Jul 26, 2024During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests oCVE-2024-6490 · WordPress plugins & themes · reported by WPScanMedium 6.5
During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.
- Product
- Master Slider
- Affected
- up to 3.9.10
- What to do
- Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024Community Events: Does not have CSRF check in placeCVE-2024-6271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack
- Product
- Community Events
- Fixed in
- 1.5
- What to do
- Update Community Events to 1.5 or newer.
Jul 22, 2024PZ Frontend Manager: Does not have CSRF checks in some placesCVE-2024-6244 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- PZ Frontend Manager
- Fixed in
- 1.0.6
- What to do
- Update PZ Frontend Manager to 1.0.6 or newer.
Jul 19, 2024ArtPlacer Widget: Does not have CSRF check in some placesCVE-2023-7269 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- ArtPlacer Widget
- Fixed in
- 2.21.2
- What to do
- Update ArtPlacer Widget to 2.21.2 or newer.
Jul 15, 2024wp-cart-for-digital-products: Does not have CSRF checks in some placesCVE-2024-6075 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.5
- What to do
- Update wp-cart-for-digital-products to 8.5.5 or newer.
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5287 · WordPress plugins & themes · reported by WPScanHigh 7.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in some placesCVE-2024-5284 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in some placesCVE-2024-5280 · WordPress plugins & themes · reported by WPScanMedium 4.7
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024CM Email Registration Blacklist and Whitelist: Does not have CSRF checkCVE-2024-5167 · WordPress plugins & themes · reported by WPScanHigh 8.1
The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or whitelist, which could allow attackers to make a logged in admin add or delete settings from the blacklist or whitelist menu via a CSRF attack
- Product
- CM Email Registration Blacklist and Whitelist
- Fixed in
- 1.4.9
- What to do
- Update CM Email Registration Blacklist and Whitelist to 1.4.9 or newer.
Jul 13, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5077 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024wp-eMember: Does not have CSRF checks in some placesCVE-2024-5076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024SULly: Does not have CSRF checks in some placesCVE-2024-5034 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- SULly
- Fixed in
- 4.3.1
- What to do
- Update SULly to 4.3.1 or newer.
Jul 13, 2024SULly: Does not have CSRF check in some placesCVE-2024-5033 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- SULly
- Fixed in
- 4.3.1
- What to do
- Update SULly to 4.3.1 or newer.
Jul 13, 2024CM WordPress Search And Replace: Does not have CSRF checks in some placesCVE-2024-5028 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- CM WordPress Search And Replace
- Fixed in
- 1.3.9
- What to do
- Update CM WordPress Search And Replace to 1.3.9 or newer.
Jul 13, 2024Smart Image Gallery: Does not have CSRF check in placeCVE-2024-3632 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Smart Image Gallery
- Fixed in
- 1.0.19
- What to do
- Update Smart Image Gallery to 1.0.19 or newer.
Jul 12, 2024Internal Link Juicer: SEO Auto Linker for: Cross-Site Request Forgery (CSRF)CVE-2024-37941 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Juicer: SEO Auto Linker for WordPress: from n/a through 2.24.3.
- Product
- Internal Link Juicer: SEO Auto Linker for
- Affected
- up to 2.24.3
- What to do
- Affects up to 2.24.3. Update Internal Link Juicer: SEO Auto Linker for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Seraphinite Accelerator (Full, premium): Cross-Site Request Forgery (CSRF)CVE-2024-37940 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Full, premium): from n/a through 2.21.13.
- Product
- Seraphinite Accelerator (Full, premium)
- Affected
- up to 2.21.13
- What to do
- Affects up to 2.21.13. Update Seraphinite Accelerator (Full, premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Patricia Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37939 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Lite.This issue affects Patricia Lite: from n/a through 1.2.3.
- Product
- Patricia Lite
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Patricia Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024SociallyViral: Cross-Site Request Forgery (CSRF)CVE-2024-37938 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop SociallyViral.This issue affects SociallyViral: from n/a through 1.0.10.
- Product
- SociallyViral
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update SociallyViral to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024AliNext: Cross-Site Request Forgery (CSRF)CVE-2024-37213 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in guru-aliexpress AliNext ali2woo-lite allows Cross Site Request Forgery.This issue affects AliNext: from n/a through <= 3.4.6.
- Product
- AliNext
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update AliNext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Comment Reply Email: Cross-Site Request Forgery (CSRF)CVE-2024-35773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting (XSS).This issue affects Comment Reply Email: from n/a through 1.3.
- Product
- Comment Reply Email
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Comment Reply Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6024 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6023 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6022 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2024VikRentCar Car Rental Management System: Does not have CSRF checks in some placesCVE-2024-1845 · WordPress plugins & themes · reported by WPScanHigh 8.8
The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.3.2
- What to do
- Update VikRentCar Car Rental Management System to 1.3.2 or newer.
Jul 9, 2024Cliengo – Chatbot: Cross-Site Request Forgery (CSRF)CVE-2024-37923 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: from n/a through <= 3.0.4.
- Product
- Cliengo – Chatbot
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 3, 2024WPQA Builder: Does not have CSRF checks in some placesCVE-2024-2376 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WPQA Builder
- Fixed in
- 6.1.1
- What to do
- Update WPQA Builder to 6.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2040 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 2, 2024sitetweet: Does not have CSRF check in some placesCVE-2024-5767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- sitetweet
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update sitetweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Muslim Prayer Time BD: Does not have CSRF check in placeCVE-2024-4758 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Muslim Prayer Time BD
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Muslim Prayer Time BD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2024Logo Manager For Enamad: Does not have CSRF check in some placesCVE-2024-4757 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Logo Manager For Enamad
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Book Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37230 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Book Landing Page.This issue affects Book Landing Page: from n/a through 1.2.3.
- Product
- Book Landing Page
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Newsletters: Cross Site Request Forgery (CSRF)CVE-2024-37227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7.
- Product
- Newsletters
- Affected
- up to 4.9.7
- What to do
- Affects up to 4.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Ali2Woo Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37212 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
- Product
- Ali2Woo Lite
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ali2Woo Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Digital Newspaper: Cross-Site Request Forgery (CSRF)CVE-2024-37198 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.5.
- Product
- Digital Newspaper
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Digital Newspaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Uncanny Automator Pro: Cross Site Request Forgery (CSRF)CVE-2024-37118 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.This issue affects Uncanny Automator Pro: from n/a through 5.3.
- Product
- Uncanny Automator Pro
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Uncanny Automator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Hueman: Cross-Site Request Forgery (CSRF)CVE-2024-35772 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24.
- Product
- Hueman
- Affected
- up to 3.7.24
- What to do
- Affects up to 3.7.24. Update Hueman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.