Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,631 results · page 38 of 73

Apr 24, 2024Headline Analyzer: Cross-Site Request Forgery (CSRF)CVE-2024-32806 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule Headline Analyzer.This issue affects Headline Analyzer: from n/a through 1.3.3.
Product
Headline Analyzer
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Headline Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WPCal.Io – Easy Meeting Scheduler: Cross-Site Request Forgery (CSRF)CVE-2024-32795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.
Product
WPCal.Io – Easy Meeting Scheduler
Affected
up to 0.9.5.8
What to do
Affects up to 0.9.5.8. Update WPCal.Io – Easy Meeting Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Paid Memberships Pro: Cross-Site Request Forgery (CSRF)CVE-2024-32794 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.
Product
Paid Memberships Pro
Affected
up to 2.12.10
What to do
Affects up to 2.12.10. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Paid Memberships Pro: Cross-Site Request Forgery (CSRF)CVE-2024-32793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.
Product
Paid Memberships Pro
Affected
up to 2.12.10
What to do
Affects up to 2.12.10. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Royal Elementor Kit: Cross-Site Request Forgery (CSRF)CVE-2024-32773 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Royal Royal Elementor Kit.This issue affects Royal Elementor Kit: from n/a through 1.0.116.
Product
Royal Elementor Kit
Affected
up to 1.0.116
What to do
Affects up to 1.0.116. Update Royal Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Paid Member Subscriptions: Cross-Site Request Forgery (CSRF)CVE-2024-32728 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.11.0.
Product
Paid Member Subscriptions
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024YITH WooCommerce Compare: Cross-Site Request Forgery (CSRF)CVE-2024-32699 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare.This issue affects YITH WooCommerce Compare: from n/a through <= 2.37.0.
Product
YITH WooCommerce Compare
Affected
up to 2.37.0
What to do
Affects up to 2.37.0. Update YITH WooCommerce Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Seers: Cross-Site Request Forgery (CSRF)CVE-2024-32789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Seers allows Cross-Site Scripting (XSS).This issue affects Seers: from n/a through 8.1.0.
Product
Seers
Affected
up to 8.1.0
What to do
Affects up to 8.1.0. Update Seers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024The Pack Elementor addons: Cross-Site Request Forgery (CSRF)CVE-2024-32785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Webangon The Pack Elementor addons allows Cross-Site Scripting (XSS).This issue affects The Pack Elementor addons: from n/a through 2.0.8.3.
Product
The Pack Elementor addons
Affected
up to 2.0.8.3
What to do
Affects up to 2.0.8.3. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in an AJAX actionCVE-2024-1756 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name
Product
WooCommerce Customers Manager
Fixed in
29.8
What to do
Update WooCommerce Customers Manager to 29.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2024Automatic: Cross-Site Request Forgery (CSRF)CVE-2024-32693 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Cross-Site Request Forgery (CSRF) vulnerability in ValvePress Automatic.This issue affects Automatic: from n/a before 3.93.0.
Product
Automatic
Fixed in
3.93.0
What to do
Update Automatic to 3.93.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024PeproDev CF7 Database: Cross-Site Request Forgery (CSRF)CVE-2023-41864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0.
Product
PeproDev CF7 Database
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update PeproDev CF7 Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Easy CountDowner: Cross-Site Request Forgery (CSRF)CVE-2024-32538 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Joshua Eldridge Easy CountDowner allows Stored XSS.This issue affects Easy CountDowner: from n/a through 1.0.8.
Product
Easy CountDowner
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Easy CountDowner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024BMI Adult & Kid Calculator: Cross-Site Request Forgery (CSRF)CVE-2024-32550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BMI Adult & Kid Calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through 1.2.1.
Product
BMI Adult & Kid Calculator
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update BMI Adult & Kid Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Related Posts for: Cross-Site Request Forgery (CSRF)CVE-2024-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Microkid Related Posts for WordPress allows Cross-Site Scripting (XSS).This issue affects Related Posts for WordPress: from n/a through 4.0.3.
Product
Related Posts for
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024MihanPanel: Cross-Site Request Forgery (CSRF)CVE-2024-31389 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ertano MihanPanel.This issue affects MihanPanel: from n/a before 12.7.
Product
MihanPanel
Fixed in
12.7
What to do
Update MihanPanel to 12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Table & Contact Form 7 Database – Tablesome: Cross-Site Request Forgery (CSRF)CVE-2024-31388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.25.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.25
What to do
Affects up to 1.0.25. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024ReDi Restaurant Reservation: Cross-Site Request Forgery (CSRF)CVE-2024-31385 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation.This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.
Product
ReDi Restaurant Reservation
Affected
up to 24.0128
What to do
Affects up to 24.0128. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Spa and Salon: Cross-Site Request Forgery (CSRF)CVE-2024-31384 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7.
Product
Spa and Salon
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Spa and Salon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024PopularFX: Cross-Site Request Forgery (CSRF)CVE-2024-31383 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pagelayer PopularFX.This issue affects PopularFX: from n/a through 1.2.4.
Product
PopularFX
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update PopularFX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Blocksy: Cross-Site Request Forgery (CSRF)CVE-2024-31382 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.22.
Product
Blocksy
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Spotlight Social Media Feeds: Cross-Site Request Forgery (CSRF)CVE-2024-31381 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RebelCode Spotlight Social Media Feeds.This issue affects Spotlight Social Media Feeds: from n/a through 1.6.10.
Product
Spotlight Social Media Feeds
Affected
up to 1.6.10
What to do
Affects up to 1.6.10. Update Spotlight Social Media Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Smash Balloon Social Post Feed: Cross-Site Request Forgery (CSRF)CVE-2024-31379 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1.
Product
Smash Balloon Social Post Feed
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024MailChimp Forms by MailMunch: Cross-Site Request Forgery (CSRF)CVE-2024-31378 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.1.
Product
MailChimp Forms by MailMunch
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Dashboard To-Do List: Cross-Site Request Forgery (CSRF)CVE-2024-31376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through <= 1.3.1.
Product
Dashboard To-Do List
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Dashboard To-Do List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024AppPresser: Cross-Site Request Forgery (CSRF)CVE-2024-31374 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Scott Bolinger AppPresser apppresser allows Cross Site Request Forgery.This issue affects AppPresser: from n/a through <= 4.3.0.
Product
AppPresser
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024e2pdf: Cross-Site Request Forgery (CSRF)CVE-2024-31373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
Product
e2pdf
Affected
up to 1.20.27
What to do
Affects up to 1.20.27. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Login With Ajax: Cross-Site Request Forgery (CSRF)CVE-2024-30546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1.
Product
Login With Ajax
Affected
up to 4.1
What to do
Affects up to 4.1. Update Login With Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Extra Product Options Builder for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-31940 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RedNao Extra Product Options Builder for WooCommerce.This issue affects Extra Product Options Builder for WooCommerce: from n/a through 1.2.104.
Product
Extra Product Options Builder for WooCommerce
Affected
up to 1.2.104
What to do
Affects up to 1.2.104. Update Extra Product Options Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024NewsXpress: Cross-Site Request Forgery (CSRF)CVE-2024-31938 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Themeinwp NewsXpress.This issue affects NewsXpress: from n/a through 1.0.7.
Product
NewsXpress
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update NewsXpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Page Builder: Live Composer: Cross-Site Request Forgery (CSRF)CVE-2024-31933 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.35.
Product
Page Builder: Live Composer
Affected
up to 1.5.35
What to do
Affects up to 1.5.35. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2024-31923 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page.This issue affects Feather Login Page: from n/a through 1.1.5.
Product
Feather Login Page
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024WordPress Hosting Benchmark tool: Cross-Site Request Forgery (CSRF)CVE-2024-31922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Anton Aleksandrov WordPress Hosting Benchmark tool.This issue affects WordPress Hosting Benchmark tool: from n/a through 1.3.6.
Product
WordPress Hosting Benchmark tool
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WordPress Hosting Benchmark tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Ultimate Product Catalogue: Cross-Site Request Forgery (CSRF)CVE-2024-31921 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Ultimate Product Catalogue.This issue affects Ultimate Product Catalogue: from n/a through 5.2.15.
Product
Ultimate Product Catalogue
Affected
up to 5.2.15
What to do
Affects up to 5.2.15. Update Ultimate Product Catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Currency per Product for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-31920 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Currency per Product for WooCommerce.This issue affects Currency per Product for WooCommerce: from n/a through 1.6.0.
Product
Currency per Product for WooCommerce
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Currency per Product for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-31434 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Stefano Lissa & The Newsletter Team Newsletter.This issue affects Newsletter: from n/a through 8.0.6.
Product
Newsletter
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-31433 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar.This issue affects The Events Calendar: from n/a through <= 6.3.0.
Product
The Events Calendar
Affected
up to 6.3.0
What to do
Affects up to 6.3.0. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Product Input Fields for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-31431 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0.
Product
Product Input Fields for WooCommerce
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Sarada Lite: Cross-Site Request Forgery (CSRF)CVE-2024-31429 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blossom Themes Sarada Lite.This issue affects Sarada Lite: from n/a through 1.1.2.
Product
Sarada Lite
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Sarada Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024The Conference: Cross-Site Request Forgery (CSRF)CVE-2024-31428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0.
Product
The Conference
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update The Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Marker.Io: Cross-Site Request Forgery (CSRF)CVE-2024-31427 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marker.Io Marker.Io.This issue affects Marker.Io : from n/a through 1.1.8.
Product
Marker.Io
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Marker.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Inline Related Posts: Cross-Site Request Forgery (CSRF)CVE-2024-31426 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1.
Product
Inline Related Posts
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Inline Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Amelia: Cross-Site Request Forgery (CSRF)CVE-2024-31425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95.
Product
Amelia
Affected
up to 1.0.95
What to do
Affects up to 1.0.95. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Login with phone number: Cross-Site Request Forgery (CSRF)CVE-2024-31424 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
Product
Login with phone number
Affected
up to 1.6.93
What to do
Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Favicon: Cross-Site Request Forgery (CSRF)CVE-2024-31422 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Philippe Bernard Favicon.This issue affects Favicon: from n/a through 1.3.29.
Product
Favicon
Affected
up to 1.3.29
What to do
Affects up to 1.3.29. Update Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024eCommerce Product Catalog: Cross-Site Request Forgery (CSRF)CVE-2024-32437 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in impleCode eCommerce Product Catalog.This issue affects eCommerce Product Catalog: from n/a through 3.3.28.
Product
eCommerce Product Catalog
Affected
up to 3.3.28
What to do
Affects up to 3.3.28. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Gift Vouchers: Cross-Site Request Forgery (CSRF)CVE-2024-32436 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Codemenschen Gift Vouchers.This issue affects Gift Vouchers: from n/a through 4.4.0.
Product
Gift Vouchers
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update Gift Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024AffiEasy: Cross-Site Request Forgery (CSRF)CVE-2024-32435 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in perrinalexandre05 AffiEasy affieasy.This issue affects AffiEasy: from n/a through <= 1.1.4.
Product
AffiEasy
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update AffiEasy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Order Delivery Date for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-32434 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce.This issue affects Order Delivery Date for WooCommerce: from n/a through 3.20.2.
Product
Order Delivery Date for WooCommerce
Affected
up to 3.20.2
What to do
Affects up to 3.20.2. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024BEAF: Cross-Site Request Forgery (CSRF)CVE-2024-32433 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Themefic BEAF beaf-before-and-after-gallery.This issue affects BEAF: from n/a through <= 4.5.4.
Product
BEAF
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update BEAF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.