Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,631 results · page 42 of 73

Feb 29, 2024Ajax Search Lite: Cross-Site Request Forgery (CSRF)CVE-2024-21752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through 4.11.4.
Product
Ajax Search Lite
Affected
up to 4.11.4
What to do
Affects up to 4.11.4. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51696 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
Product
Spam protection, Anti-Spam, FireWall by CleanTalk
Affected
up to 6.20
What to do
Affects up to 6.20. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024Thrive Automator: Cross-Site Request Forgery (CSRF)CVE-2023-51531 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Automator.This issue affects Thrive Automator: from n/a through 1.17.
Product
Thrive Automator
Affected
up to 1.17
What to do
Affects up to 1.17. Update Thrive Automator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: Cross-Site Request Forgery (CSRF)CVE-2023-51530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation.This issue affects Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: from n/a through 3.5.1.
Product
Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024HT Mega – Absolute Addons For Elementor: Cross-Site Request Forgery (CSRF)CVE-2023-51529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor.This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.3.
Product
HT Mega – Absolute Addons For Elementor
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024AI Power: Complete AI Pack – Powered by GPT-4: Cross-Site Request Forgery (CSRF)CVE-2023-51528 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.12.
Product
AI Power: Complete AI Pack – Powered by GPT-4
Affected
up to 1.8.12
What to do
Affects up to 1.8.12. Update AI Power: Complete AI Pack – Powered by GPT-4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Change Table Prefix: Cross-Site Request Forgery (CSRF)CVE-2024-25932 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Manish Kumar Agarwal Change Table Prefix change-table-prefix allows Cross Site Request Forgery.This issue affects Change Table Prefix: from n/a through <= 2.0.
Product
Change Table Prefix
Affected
up to 2.0
What to do
Affects up to 2.0. Update Change Table Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Heureka: Cross-Site Request Forgery (CSRF)CVE-2024-25931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Heureka Group Heureka.This issue affects Heureka: from n/a through 1.0.8.
Product
Heureka
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Heureka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Custom Order Statuses for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-25930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
Product
Custom Order Statuses for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Custom Order Statuses for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024W3SPEEDSTER: Cross-Site Request Forgery (CSRF)CVE-2024-24708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.19.
Product
W3SPEEDSTER
Affected
up to 7.19
What to do
Affects up to 7.19. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024A no-code page builder for beautiful performance-based content: Cross-Site Request Forgery (CSRF)CVE-2024-24701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code page builder for beautiful performance-based content: from n/a through 2.1.20.
Product
A no-code page builder for beautiful performance-based content
Affected
up to 2.1.20
What to do
Affects up to 2.1.20. Update A no-code page builder for beautiful performance-based content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Email Before Download: Cross-Site Request Forgery (CSRF)CVE-2024-23519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7.
Product
Email Before Download
Affected
up to 6.9.7
What to do
Affects up to 6.9.7. Update Email Before Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Atahualpa: Cross-Site Request Forgery (CSRF)CVE-2024-27948 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24.
Product
Atahualpa
Affected
up to 3.7.24
What to do
Affects up to 3.7.24. Update Atahualpa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Ecwid Ecommerce Shopping Cart: Cross-Site Request Forgery (CSRF)CVE-2023-51533 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.
Product
Ecwid Ecommerce Shopping Cart
Affected
up to 6.12.4
What to do
Affects up to 6.12.4. Update Ecwid Ecommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 20241 click disable all: Cross-Site Request Forgery (CSRF)CVE-2024-21749 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1.
Product
1 click disable all
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update 1 click disable all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Advanced Flamingo: Cross-Site Request Forgery (CSRF)CVE-2023-52226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
Product
Advanced Flamingo
Affected
up to 1.0
What to do
Affects up to 1.0. Update Advanced Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024MailerLite – WooCommerce integration: Cross-Site Request Forgery (CSRF)CVE-2023-52223 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.
Product
MailerLite – WooCommerce integration
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request Forgery (CSRF)CVE-2023-51683 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
Product
Easy PayPal & Stripe Buy Now Button
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Duplicator – WordPress Migration & Backup: Cross-Site Request Forgery (CSRF)CVE-2023-51681 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migration & Backup Plugin: from n/a through 1.5.7.
Product
Duplicator – WordPress Migration & Backup
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Duplicator – WordPress Migration & Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record https https
Feb 28, 2024Accessibility: Cross-Site Request Forgery (CSRF)CVE-2024-24705 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6.
Product
Accessibility
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Page Restrict: Cross-Site Request Forgery (CSRF)CVE-2024-24702 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5.
Product
Page Restrict
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Page Restrict to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 27, 2024Fatal Error Notify: Does not have authorisation and CSRF checks in its test_error AJAX actionCVE-2023-7202 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF
Product
Fatal Error Notify
Fixed in
1.5.3
What to do
Update Fatal Error Notify to 1.5.3 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Feb 21, 2024FG PrestaShop to WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-24837 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce, Frédéric GILLES FG Drupal to WordPress, Frédéric GILLES FG Joomla to WordPress.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.44.3; FG Drupal to WordPress: from n/a through 3.67.0; FG Joomla to WordPress: from n/a through 4.15.0.
Product
FG PrestaShop to WooCommerce
Affected
up to 4.44.3
What to do
Affects up to 4.44.3. Update FG PrestaShop to WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024JTRT Responsive Tables: Cross-Site Request Forgery (CSRF)CVE-2024-24802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9.
Product
JTRT Responsive Tables
Affected
up to 4.1.9
What to do
Affects up to 4.1.9. Update JTRT Responsive Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Debug: Cross-Site Request Forgery (CSRF)CVE-2024-24798 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10.
Product
Debug
Affected
up to 1.10
What to do
Affects up to 1.10. Update Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Multi Step Form: Cross-Site Request Forgery (CSRF)CVE-2024-25905 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18.
Product
Multi Step Form
Affected
up to 1.7.18
What to do
Affects up to 1.7.18. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024TinyMCE and TinyMCE Advanced Professsional Formats and Styles: Cross-Site Request Forgery (CSRF)CVE-2024-25904 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and TinyMCE Advanced Professsional Formats and Styles: from n/a through 1.1.2.
Product
TinyMCE and TinyMCE Advanced Professsional Formats and Styles
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update TinyMCE and TinyMCE Advanced Professsional Formats and Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Admin Menu Editor: Cross-Site Request Forgery (CSRF)CVE-2024-24876 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12.
Product
Admin Menu Editor
Affected
up to 1.12
What to do
Affects up to 1.12. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Themify Builder: Cross-Site Request Forgery (CSRF)CVE-2024-24872 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.
Product
Themify Builder
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Quicksand Post Filter jQuery: Cross-Site Request Forgery (CSRF)CVE-2024-24849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024PowerPack Pro for Elementor: Cross-Site Request Forgery (CSRF)CVE-2024-24843 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a before 2.10.8.
Product
PowerPack Pro for Elementor
Fixed in
2.10.8
What to do
Update PowerPack Pro for Elementor to 2.10.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 13, 2024SMTP Mail: Cross-Site Request Forgery (CSRF)CVE-2024-25914 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20.
Product
SMTP Mail
Affected
up to 1.3.20
What to do
Affects up to 1.3.20. Update SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Splashscreen: Does not have CSRF check in placeCVE-2023-6501 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Splashscreen
Affected
up to 0.20
What to do
Affects up to 0.20. Update Splashscreen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Feb 12, 2024lasTunes: Does not have CSRF check in some placesCVE-2023-6499 · WordPress plugins & themes · reported by WPScanMedium 5.4
The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
lasTunes
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update lasTunes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 12, 2024Basic Log Viewer: Cross-Site Request Forgery (CSRF)CVE-2024-24935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4.
Product
Basic Log Viewer
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Basic Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024WP Contact Form: Cross-Site Request Forgery (CSRF)CVE-2024-24929 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ryan Duff, Peter Westwood WP Contact Form.This issue affects WP Contact Form: from n/a through 1.6.
Product
WP Contact Form
Affected
up to 1.6
What to do
Affects up to 1.6. Update WP Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-24887 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.
Product
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for
Affected
up to 21.2.8.4
What to do
Affects up to 21.2.8.4. Update Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Contact Form 7 Connector: Cross-Site Request Forgery (CSRF)CVE-2024-24884 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 Connector: from n/a through 1.2.2.
Product
Contact Form 7 Connector
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Contact Form 7 Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Link Library: Cross-Site Request Forgery (CSRF)CVE-2024-24875 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13.
Product
Link Library
Affected
up to 7.5.13
What to do
Affects up to 7.5.13. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 7, 2024WP-CFM: Cross-Site Request Forgery (CSRF)CVE-2024-24706 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8.
Product
WP-CFM
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update WP-CFM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com patchstack.com
Jan 31, 2024Profile Builder Pro: Cross-Site Request Forgery (CSRF)CVE-2024-22140 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.
Product
Profile Builder Pro
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update Profile Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder: Cross-Site Request Forgery (CSRF)CVE-2024-22136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder.This issue affects Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder: from n/a through 3.1.5.
Product
Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024FreshMail For: Cross-Site Request Forgery (CSRF)CVE-2024-22304 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.
Product
FreshMail For
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update FreshMail For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Browser Theme Color: Cross-Site Request Forgery (CSRF)CVE-2024-22291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Browser Theme Color.This issue affects Browser Theme Color: from n/a through 1.3.
Product
Browser Theme Color
Affected
up to 1.3
What to do
Affects up to 1.3. Update Browser Theme Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Frontpage Manager: Cross-Site Request Forgery (CSRF)CVE-2024-22285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3.
Product
Frontpage Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Frontpage Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WP Spell Check: Cross-Site Request Forgery (CSRF)CVE-2024-22143 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17.
Product
WP Spell Check
Affected
up to 9.17
What to do
Affects up to 9.17. Update WP Spell Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Custom Dashboard Widgets: Cross-Site Request Forgery (CSRF)CVE-2024-22290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom Dashboard Widgets: from n/a through 1.3.1.
Product
Custom Dashboard Widgets
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Custom Dashboard Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Better Anchor Links: Cross-Site Request Forgery (CSRF)CVE-2024-22287 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.
Product
Better Anchor Links
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Better Anchor Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 29, 2024WP SOCIAL BOOKMARK MENU: Does not have CSRF check in placeCVE-2023-7074 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
WP SOCIAL BOOKMARK MENU
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP SOCIAL BOOKMARK MENU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024Autotitle for: Does not have CSRF check in placeCVE-2023-6946 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Autotitle for
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Autotitle for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.