Vulnerability database

5,764 results · page 43 of 116

• Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.CVE-2023-28618 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.

  Affected

  up to 1.16

  What to do

  Affects up to 1.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.CVE-2023-28498 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.

  Affected

  up to 4.6.0

  What to do

  Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.CVE-2023-28497 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.CVE-2023-28495 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.

  Affected

  up to 1.4.16

  What to do

  Affects up to 1.4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions.CVE-2023-31078 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions.

  Affected

  up to 4.4.1

  What to do

  Affects up to 4.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.CVE-2023-31077 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.

  Affected

  up to 2.1.9

  What to do

  Affects up to 2.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.CVE-2023-30478 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.

  Affected

  up to 4.8.8

  What to do

  Affects up to 4.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions.CVE-2023-29440 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions.

  Affected

  up to 2.10.3

  What to do

  Affects up to 2.10.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.CVE-2023-29428 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions.CVE-2023-32502 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions.

  Fixed in

  2.0.0

  What to do

  Update the plugin to 2.0.0 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.CVE-2023-32125 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.CVE-2023-32093 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.

  Fixed in

  1.0.8

  What to do

  Update the plugin to 1.0.8 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versioCVE-2023-32092 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versions.

  Fixed in

  6.1.0.0

  What to do

  Update the plugin to 6.1.0.0 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.CVE-2023-31235 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.

  Fixed in

  2.5.0

  What to do

  Update the plugin to 2.5.0 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions.CVE-2023-31093 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions.

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions.CVE-2023-31088 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions.

  Fixed in

  1.2.2

  What to do

  Update the plugin to 1.2.2 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versCVE-2023-31086 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versions.

  Fixed in

  2.46.1

  What to do

  Update the plugin to 2.46.1 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.CVE-2023-32592 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <= 1.3.8 versions.CVE-2023-32587 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <= 1.3.8 versions.

  Fixed in

  1.3.9

  What to do

  Update the plugin to 1.3.9 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions.CVE-2023-32579 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions.

  Fixed in

  2.1.3

  What to do

  Update the plugin to 2.1.3 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions.CVE-2023-32512 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions.

  Fixed in

  3.7.2

  What to do

  Update the plugin to 3.7.2 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.CVE-2023-34031 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.CVE-2023-34025 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.

  Affected

  up to 2.1.6

  What to do

  Affects up to 2.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions.CVE-2023-34024 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions.

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions.CVE-2023-32794 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions.

  Affected

  up to 6.1.3

  What to do

  Affects up to 6.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions.CVE-2023-32745 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions.

  Affected

  up to 5.7.1

  What to do

  Affects up to 5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.CVE-2023-32744 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.

  Fixed in

  2.3.0

  What to do

  Update the plugin to 2.3.0 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.CVE-2023-32739 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.

  Fixed in

  3.2

  What to do

  Update the plugin to 3.2 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions.CVE-2023-32602 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions.

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions.CVE-2023-32594 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions.

  Affected

  up to 5.1.5

  What to do

  Affects up to 5.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.CVE-2023-34177 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions.CVE-2023-34171 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions.

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions.CVE-2023-34033 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions.

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions.CVE-2023-47238 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions.

  Fixed in

  3.3.3

  What to do

  Update the plugin to 3.3.3 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions.CVE-2023-47237 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions.

  Fixed in

  3.8

  What to do

  Update the plugin to 3.8 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.CVE-2023-34371 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.

  Affected

  up to 2.22

  What to do

  Affects up to 2.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions.CVE-2023-34182 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions.

  Affected

  up to 1.55

  What to do

  Affects up to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions.CVE-2023-34181 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions.

  Affected

  up to 0.6.11

  What to do

  Affects up to 0.6.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.CVE-2023-46614 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.

  Fixed in

  4.5.2

  What to do

  Update the plugin to 4.5.2 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.CVE-2023-34386 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.

  Fixed in

  4.7.2

  What to do

  Update the plugin to 4.7.2 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions.CVE-2023-34002 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions.

  Fixed in

  2.1.0.14

  What to do

  Update the plugin to 2.1.0.14 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.CVE-2023-31087 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.

  Fixed in

  2.0.1

  What to do

  Update the plugin to 2.0.1 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.CVE-2023-25975 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.

  Fixed in

  3.0.4

  What to do

  Update the plugin to 3.0.4 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions.CVE-2023-25994 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions.

  Fixed in

  4.5.4

  What to do

  Update the plugin to 4.5.4 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1

  Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.

  Product

  Directorist – WordPress Business Directory Plugin with Classified Ads Listings

  Affected

  up to 7.7.1

  What to do

  Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 7, 2023Simple Newsletter Plugin – Noptin: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46803 · WordPress plugins & themes · reported by PatchstackMedium 6.1

  Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.

  Product

  Simple Newsletter Plugin – Noptin

  Affected

  up to 1.9.5

  What to do

  Affects up to 1.9.5. Update Simple Newsletter Plugin – Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 7, 2023Social Sharing Plugin - Social Warfare: Stored Cross-Site ScriptingCVE-2023-4842 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Social Sharing Plugin - Social Warfare

  Affected

  up to 4.4.3

  What to do

  Affects up to 4.4.3. Update Social Sharing Plugin - Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.CVE-2023-5823 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.

  Affected

  up to 2.2.11

  What to do

  Affects up to 2.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.CVE-2023-47186 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.

  Affected

  up to 1.5.11

  What to do

  Affects up to 1.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions.CVE-2023-46781 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions.

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.