Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,631 results · page 36 of 73
Jun 21, 2024Customizr: Cross-Site Request Forgery (CSRF)CVE-2024-35771 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Customizr.This issue affects Customizr: from n/a through 4.4.21.
- Product
- Customizr
- Affected
- up to 4.4.21
- What to do
- Affects up to 4.4.21. Update Customizr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Vimeography: Vimeo Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2024-35770 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gallery WordPress Plugin: from n/a through 2.4.1.
- Product
- Vimeography: Vimeo Video Gallery
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Vimeography: Vimeo Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Widget Bundle: Does not have CSRF checksCVE-2024-4969 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/disable widgets via a CSRF attack
- Product
- Widget Bundle
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024WP Logs Book: Does not have CSRF checkCVE-2024-4475 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack
- Product
- WP Logs Book
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024WP Logs Book: Does not have CSRF check in placeCVE-2024-4474 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Logs Book
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024CB (legacy): Does not have CSRF checks in some bulk actionsCVE-2024-4382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks
- Product
- CB (legacy)
- Affected
- up to 0.9.4.18
- What to do
- Affects up to 0.9.4.18. Update CB (legacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2024GamiPress: Cross-Site Request Forgery (CSRF)CVE-2023-25697 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6.
- Product
- GamiPress
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 19, 2024Master Slider: Cross-Site Request Forgery (CSRF)CVE-2023-50900 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10.
- Product
- Master Slider
- Affected
- up to 3.9.10
- What to do
- Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 14, 2024Inquiry cart: Does not have CSRF check in some placesCVE-2024-5155 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Inquiry cart
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Inquiry cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024WP Prayer II: Does not have CSRF check in placeCVE-2024-4751 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer II
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update WP Prayer II to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024WP Prayer II: Does not have CSRF check in placeCVE-2024-4480 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer II
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update WP Prayer II to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024AZAN: Does not have CSRF check in some placesCVE-2024-3993 · WordPress plugins & themes · reported by WPScanMedium 4.6
The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- AZAN
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update AZAN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Similarity: Does not have CSRF check in some placesCVE-2024-3972 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Similarity
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Similarity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Similarity: Does not have CSRF check in placeCVE-2024-3971 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Similarity
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Similarity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Pray For Me: Does not have CSRF check in placeCVE-2024-3965 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Pray For Me
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Pray For Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2024Grab & Save: Cross-Site Request Forgery (CSRF)CVE-2023-47845 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lim Kai Yang Grab & Save.This issue affects Grab & Save: from n/a through 1.0.4.
- Product
- Grab & Save
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Grab & Save to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024WP-Recall: Cross-Site Request Forgery (CSRF)CVE-2024-35657 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6.
- Product
- WP-Recall
- Affected
- up to 16.26.6
- What to do
- Affects up to 16.26.6. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024Analytify: Cross-Site Request Forgery (CSRF)CVE-2024-35689 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3.
- Product
- Analytify
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024ElasticPress: Cross-Site Request Forgery (CSRF)CVE-2024-35684 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1.
- Product
- ElasticPress
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update ElasticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 7, 2024WP Stacker: Does not have CSRF check in some placesCVE-2024-5003 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- WP Stacker
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update WP Stacker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2024Pure Chat: Cross-Site Request Forgery (CSRF)CVE-2024-35673 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22.
- Product
- Pure Chat
- Affected
- up to 2.22
- What to do
- Affects up to 2.22. Update Pure Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 3, 2024Integration for Contact Form 7 and Constant Contact: Cross-Site Request Forgery (CSRF)CVE-2024-35632 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.
- Product
- Integration for Contact Form 7 and Constant Contact
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Integration for Contact Form 7 and Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 3, 2024ActiveDEMAND: Cross-Site Request Forgery (CSRF)CVE-2024-35638 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43.
- Product
- ActiveDEMAND
- Affected
- up to 0.2.43
- What to do
- Affects up to 0.2.43. Update ActiveDEMAND to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 1, 2024Uploadcare File Uploader and Adaptive Delivery (beta): Cross-Site Request Forgery (CSRF)CVE-2024-35636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery (beta): from n/a through 3.0.11.
- Product
- Uploadcare File Uploader and Adaptive Delivery (beta)
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Uploadcare File Uploader and Adaptive Delivery (beta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 27, 2024KKProgressbar2 Free: Does not have CSRF checks in some placesCVE-2024-4535 · WordPress plugins & themes · reported by WPScanHigh 8.8
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- KKProgressbar2 Free
- Affected
- up to 1.1.4.2
- What to do
- Affects up to 1.1.4.2. Update KKProgressbar2 Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024KKProgressbar2 Free: Does not have CSRF check in some placesCVE-2024-4534 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- KKProgressbar2 Free
- Affected
- up to 1.1.4.2
- What to do
- Affects up to 1.1.4.2. Update KKProgressbar2 Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024Business Card: Does not have CSRF checks in some placesCVE-2024-4532 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024Business Card: Does not have CSRF checks in some placesCVE-2024-4531 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024Business Card: Does not have CSRF checks in some placesCVE-2024-4530 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing card categories via CSRF attacks
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024Business Card: Does not have CSRF checks in some placesCVE-2024-4529 · WordPress plugins & themes · reported by WPScanMedium 5
The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting card categories via CSRF attacks
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024EmpowerWP: Cross-Site Request Forgery (CSRF)CVE-2024-34809 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.
- Product
- EmpowerWP
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update EmpowerWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Fast Custom Social Share by CodeBard: Cross-Site Request Forgery (CSRF)CVE-2024-34807 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CodeBard Fast Custom Social Share by CodeBard fast-custom-social-share-by-codebard.This issue affects Fast Custom Social Share by CodeBard: from n/a through <= 1.1.2.
- Product
- Fast Custom Social Share by CodeBard
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Fast Custom Social Share by CodeBard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Clearfy Cache: Cross-Site Request Forgery (CSRF)CVE-2024-34806 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creative Motion Clearfy Cache.This issue affects Clearfy Cache: from n/a through 2.2.1.
- Product
- Clearfy Cache
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Clearfy Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Integration for Contact Form 7 HubSpot: Cross-Site Request Forgery (CSRF)CVE-2024-34756 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 HubSpot.This issue affects Integration for Contact Form 7 HubSpot: from n/a through 1.3.1.
- Product
- Integration for Contact Form 7 HubSpot
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Integration for Contact Form 7 HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Integration for Contact Form 7 and Salesforce: Cross-Site Request Forgery (CSRF)CVE-2024-34755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9.
- Product
- Integration for Contact Form 7 and Salesforce
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Integration for Contact Form 7 and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Automatic: Cross-Site Request Forgery (CSRF)CVE-2024-27955 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in WP Automatic Automatic allows Privilege Escalation.This issue affects Automatic: from n/a through 3.92.0.
- Product
- Automatic
- Affected
- up to 3.92.0
- What to do
- Affects up to 3.92.0. Update Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Events Rich Snippets for Google: Cross-Site Request Forgery (CSRF)CVE-2023-44478 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WP Hive Events Rich Snippets for Google allows Exploitation of Trusted Credentials.This issue affects Events Rich Snippets for Google: from n/a through 1.8.
- Product
- Events Rich Snippets for Google
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Events Rich Snippets for Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 16, 2024Newsletter Popup: Does not have CSRF checkCVE-2024-3643 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not have CSRF checkCVE-2024-3642 · WordPress plugins & themes · reported by WPScanMedium 6.9
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not have CSRF check in placeCVE-2024-3824 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not have CSRF checkCVE-2024-3823 · WordPress plugins & themes · reported by WPScanLow 2.4
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024HL Twitter: Does not have CSRF checkCVE-2024-3631 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024HL Twitter: Does not have CSRF check in placeCVE-2024-3629 · WordPress plugins & themes · reported by WPScanLow 2.4
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF checks in some placesCVE-2024-3407 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF check in placeCVE-2024-3406 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF check in placeCVE-2024-3405 · WordPress plugins & themes · reported by WPScanHigh 7.6
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024ShortPixel Adaptive Images: Cross-Site Request Forgery (CSRF)CVE-2024-4689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.
- Product
- ShortPixel Adaptive Images
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in some placesCVE-2024-3941 · WordPress plugins & themes · reported by WPScanMedium 4.7
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in placeCVE-2024-3940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Add Custom CSS and JS: Does not have CSRF check in some placesCVE-2024-3903 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack
- Product
- Add Custom CSS and JS
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update Add Custom CSS and JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.