Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,631 results · page 37 of 73
May 14, 2024LetterPress: Does not have CSRF checks in some placesCVE-2024-3590 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers
- Product
- LetterPress
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update LetterPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024UnGallery: Does not have CSRF check in some placesCVE-2024-3582 · WordPress plugins & themes · reported by WPScanMedium 4.8
The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- UnGallery
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update UnGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Church Admin: Cross-Site Request Forgery (CSRF)CVE-2024-34828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.
- Product
- Church Admin
- Affected
- up to 4.1.32
- What to do
- Affects up to 4.1.32. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024TranslatePress: Cross-Site Request Forgery (CSRF)CVE-2024-34827 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects TranslatePress: from n/a through 2.7.5.
- Product
- TranslatePress
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Social Warfare: Cross-Site Request Forgery (CSRF)CVE-2024-34825 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Warfare Plugins Social Warfare.This issue affects Social Warfare: from n/a through 4.4.5.1.
- Product
- Social Warfare
- Affected
- up to 4.4.5.1
- What to do
- Affects up to 4.4.5.1. Update Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Arigato Autoresponder and Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-34823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.3.
- Product
- Arigato Autoresponder and Newsletter
- Affected
- up to 2.7.2.3
- What to do
- Affects up to 2.7.2.3. Update Arigato Autoresponder and Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024WebinarPress: Cross-Site Request Forgery (CSRF)CVE-2024-34818 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress.This issue affects WebinarPress: from n/a through 1.33.17.
- Product
- WebinarPress
- Affected
- up to 1.33.17
- What to do
- Affects up to 1.33.17. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2024-34817 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.0.
- Product
- Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024WPCal.Io – Easy Meeting Scheduler: Cross-Site Request Forgery (CSRF)CVE-2024-34816 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.
- Product
- WPCal.Io – Easy Meeting Scheduler
- Affected
- up to 0.9.5.8
- What to do
- Affects up to 0.9.5.8. Update WPCal.Io – Easy Meeting Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Unyson: Cross-Site Request Forgery (CSRF)CVE-2024-34814 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Unyson Unyson unyson.This issue affects Unyson: from n/a through <= 2.7.29.
- Product
- Unyson
- Affected
- up to 2.7.29
- What to do
- Affects up to 2.7.29. Update Unyson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Barcode Scanner with Inventory & Order Manager: Cross-Site Request Forgery (CSRF)CVE-2024-34557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.4.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024DS Site Message: Cross-Site Request Forgery (CSRF)CVE-2024-34439 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in divSpot DS Site Message.This issue affects DS Site Message: from n/a through 1.14.4.
- Product
- DS Site Message
- Affected
- up to 1.14.4
- What to do
- Affects up to 1.14.4. Update DS Site Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024WP Favorite Posts: Cross-Site Request Forgery (CSRF)CVE-2024-34427 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Favorite Posts.This issue affects WP Favorite Posts: from n/a through 1.6.8.
- Product
- WP Favorite Posts
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update WP Favorite Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Easy Digital Downloads: Cross-Site Request Forgery (CSRF)CVE-2024-31113 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.
- Product
- Easy Digital Downloads
- Affected
- up to 3.2.11
- What to do
- Affects up to 3.2.11. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 6, 2024Restaurant and Cafe: Cross-Site Request Forgery (CSRF)CVE-2024-34379 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1.
- Product
- Restaurant and Cafe
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Restaurant and Cafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 6, 2024Popup box: Cross-Site Request Forgery (CSRF)CVE-2024-34367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2.
- Product
- Popup box
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 6, 2024MF Gig Calendar: Does not have CSRF checks in some placesCVE-2024-3756 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2024Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1CVE-2024-33913 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2024Counter Box: Does not have CSRF checks in some bulk actionsCVE-2024-3481 · WordPress plugins & themes · reported by WPScanMedium 5.2
The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks
- Product
- Counter Box
- Fixed in
- 1.2.4
- What to do
- Update Counter Box to 1.2.4 or newer.
May 2, 2024Herd Effects: Does not have CSRF checks in some bulk actionsCVE-2024-3478 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks
- Product
- Herd Effects
- Fixed in
- 5.2.7
- What to do
- Update Herd Effects to 5.2.7 or newer.
May 2, 2024Popup Box: Does not have CSRF checks in some bulk actionsCVE-2024-3477 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks
- Product
- Popup Box
- Fixed in
- 2.2.7
- What to do
- Update Popup Box to 2.2.7 or newer.
May 2, 2024Side Menu Lite: Does not have CSRF checks in some bulk actionsCVE-2024-3476 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Side Menu Lite
- Fixed in
- 4.2.1
- What to do
- Update Side Menu Lite to 4.2.1 or newer.
May 2, 2024Sticky Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3475 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Sticky Buttons
- Fixed in
- 3.2.4
- What to do
- Update Sticky Buttons to 3.2.4 or newer.
May 2, 2024Wow Skype Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3474 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Wow Skype Buttons
- Fixed in
- 4.0.4
- What to do
- Update Wow Skype Buttons to 4.0.4 or newer.
May 2, 2024Modal Window: Does not have CSRF check in placeCVE-2024-3472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Modal Window
- Fixed in
- 5.3.10
- What to do
- Update Modal Window to 5.3.10 or newer.
May 2, 2024Button Generator: Does not have CSRF check in placeCVE-2024-3471 · WordPress plugins & themes · reported by WPScanLow 3.4
The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
- Product
- Button Generator
- Fixed in
- 3.0
- What to do
- Update Button Generator to 3.0 or newer.
May 2, 2024Float menu: Does not have CSRF check in its bulk actionsCVE-2024-2405 · WordPress plugins & themes · reported by WPScanMedium 4.5
The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.
- Product
- Float menu
- Fixed in
- 6.0.1
- What to do
- Update Float menu to 6.0.1 or newer.
Apr 29, 2024Regenerate post permalink: Cross-Site Request Forgery (CSRF)CVE-2024-33681 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post permalink: from n/a through 1.0.3.
- Product
- Regenerate post permalink
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Regenerate post permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Piotnet Addons For Elementor Pro: Cross-Site Request Forgery (CSRF)CVE-2024-33632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
- Product
- Piotnet Addons For Elementor Pro
- Affected
- up to 7.1.17
- What to do
- Affects up to 7.1.17. Update Piotnet Addons For Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Sticky Anything: Cross-Site Request Forgery (CSRF)CVE-2024-33646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting (XSS).This issue affects Sticky Anything: from n/a through 2.1.5.
- Product
- Sticky Anything
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Sticky Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024MM-email2image: Does not have CSRF check in some placesCVE-2024-3076 · WordPress plugins & themes · reported by WPScanLow 3.8
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024OptinMonster: Cross-Site Request Forgery (CSRF)CVE-2024-33691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3.
- Product
- OptinMonster
- Affected
- up to 2.15.3
- What to do
- Affects up to 2.15.3. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Financio: Cross-Site Request Forgery (CSRF)CVE-2024-33690 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jegstudio Financio.This issue affects Financio: from n/a through 1.1.3.
- Product
- Financio
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Financio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Radio Station: Cross-Site Request Forgery (CSRF)CVE-2024-33689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station.This issue affects Radio Station: from n/a through <= 2.5.7.
- Product
- Radio Station
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Radio Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Teluro: Cross-Site Request Forgery (CSRF)CVE-2024-33688 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31.
- Product
- Teluro
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update Teluro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Hide Dashboard Notifications: Cross-Site Request Forgery (CSRF)CVE-2024-33683 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Republic Hide Dashboard Notifications.This issue affects Hide Dashboard Notifications: from n/a through 1.2.3.
- Product
- Hide Dashboard Notifications
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024WP GDPR Compliance: Cross-Site Request Forgery (CSRF)CVE-2024-33682 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23.
- Product
- WP GDPR Compliance
- Affected
- up to 2.0.23
- What to do
- Affects up to 2.0.23. Update WP GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024MainWP Child Reports: Cross-Site Request Forgery (CSRF)CVE-2024-33680 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1.
- Product
- MainWP Child Reports
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update MainWP Child Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024FameTheme Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2024-33679 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5.
- Product
- FameTheme Demo Importer
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update FameTheme Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024ClickCease Click Fraud Protection: Cross-Site Request Forgery (CSRF)CVE-2024-33678 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection.This issue affects ClickCease Click Fraud Protection: from n/a through <= 3.2.7.
- Product
- ClickCease Click Fraud Protection
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update ClickCease Click Fraud Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Contact Form 7 Extension For Mailchimp: Cross-Site Request Forgery (CSRF)CVE-2024-33677 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
- Product
- Contact Form 7 Extension For Mailchimp
- Affected
- up to 0.5.70
- What to do
- Affects up to 0.5.70. Update Contact Form 7 Extension For Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024MF Gig Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-33651 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar : from n/a through 1.2.1.
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Serious Slider: Cross-Site Request Forgery (CSRF)CVE-2024-33650 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: from n/a through 1.2.4.
- Product
- Serious Slider
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Smart Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2024-33638 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Brijesh Kothari Smart Maintenance Mode.This issue affects Smart Maintenance Mode: from n/a through 1.4.4.
- Product
- Smart Maintenance Mode
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Smart Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024ENL Newsletter: Does not have CSRF checks in some placesCVE-2024-3059 · WordPress plugins & themes · reported by WPScanMedium 5.7
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not have CSRF check in some placesCVE-2024-3058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Salon booking system: Does not have CSRF check in placeCVE-2024-2429 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2024DX-Watermark: Cross-Site Request Forgery (CSRF)CVE-2024-30560 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in 大侠WP DX-Watermark.This issue affects DX-Watermark: from n/a through 1.0.4.
- Product
- DX-Watermark
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update DX-Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Slash Admin: Cross-Site Request Forgery (CSRF)CVE-2024-32958 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Giorgos Sarigiannidis Slash Admin allows Cross-Site Scripting (XSS).This issue affects Slash Admin: from n/a through 3.8.1.
- Product
- Slash Admin
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Slash Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024WP ADA Compliance Check Basic: Cross-Site Request Forgery (CSRF)CVE-2024-32947 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3.
- Product
- WP ADA Compliance Check Basic
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update WP ADA Compliance Check Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.