Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,339 results · page 458 of 827
Jan 2, 2025WP Job Openings: Missing AuthorizationCVE-2023-45061 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awsm.in WP Job Openings wp-job-openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through <= 3.4.1.
- Product
- WP Job Openings
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update WP Job Openings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Custom Widget area: Missing AuthorizationCVE-2023-45045 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in krozero WP Custom Widget area wp-custom-widget-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Widget area: from n/a through <= 1.2.5.
- Product
- WP Custom Widget area
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Custom Widget area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP User Frontend: Missing AuthorizationCVE-2023-45002 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.
- Product
- WP User Frontend
- Affected
- up to 3.6.8
- What to do
- Affects up to 3.6.8. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Custom Admin Interface: Missing AuthorizationCVE-2023-44988 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP Custom Admin Interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through 7.32.
- Product
- WP Custom Admin Interface
- Affected
- up to 7.32
- What to do
- Affects up to 7.32. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Schema App Structured Data: Missing AuthorizationCVE-2023-44258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vberkel Schema App Structured Data schema-app-structured-data-for-schemaorg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schema App Structured Data: from n/a through <= 1.23.1.
- Product
- Schema App Structured Data
- Affected
- up to 1.23.1
- What to do
- Affects up to 1.23.1. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP SuperBackup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Reflected XSS.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Reflected XSS.This issue affects HTML Forms: from n/a through <= 1.4.1.
- Product
- HTML Forms
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025SendSMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56038 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through <= 1.2.9.
- Product
- SendSMS
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update SendSMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025User Referral: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56037 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftClever Limited User Referral user-referral-free allows Reflected XSS.This issue affects User Referral: from n/a through <= 8.0.
- Product
- User Referral
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update User Referral to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025odPhotogallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56036 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ondrej Donek odPhotogallery od-photogallery-plugin allows Reflected XSS.This issue affects odPhotogallery: from n/a through <= 0.5.3.
- Product
- odPhotogallery
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update odPhotogallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Upload Scanner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56035 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner upload-scanner allows Reflected XSS.This issue affects Upload Scanner: from n/a through <= 1.2.
- Product
- Upload Scanner
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Upload Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Services updates for customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56034 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Services updates for customers service-updates-for-customers allows Reflected XSS.This issue affects Services updates for customers: from n/a through <= 1.0.
- Product
- Services updates for customers
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Services updates for customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56033 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Reflected XSS.This issue affects FAQs: from n/a through <= 1.0.2.
- Product
- FAQs
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025FV Descriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56032 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Descriptions fv-descriptions allows Reflected XSS.This issue affects FV Descriptions: from n/a through <= 1.4.
- Product
- FV Descriptions
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update FV Descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 202510CentMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56030 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carver Lab 10CentMail 10centmail-subscription-management-and-analytics allows Reflected XSS.This issue affects 10CentMail: from n/a through <= 2.1.50.
- Product
- 10CentMail
- Affected
- up to 2.1.50
- What to do
- Affects up to 2.1.50. Update 10CentMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Easy Language Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamwinner Easy Language Switcher easy-language-switcher allows Reflected XSS.This issue affects Easy Language Switcher: from n/a through <= 1.0.
- Product
- Easy Language Switcher
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Language Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Lemonade Social Networks Autoposter Pinterest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lemonadestudio Lemonade Social Networks Autoposter Pinterest lemonade-sna-pinterest-edition allows Reflected XSS.This issue affects Lemonade Social Networks Autoposter Pinterest: from n/a through <= 2.0.
- Product
- Lemonade Social Networks Autoposter Pinterest
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Lemonade Social Networks Autoposter Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Leads CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56027 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bizswoop Leads CRM leads-crm allows Reflected XSS.This issue affects Leads CRM: from n/a through <= 2.0.13.
- Product
- Leads CRM
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Leads CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Inline Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.
- Product
- Inline Footnotes
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Inline Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025AHAthat: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-12595 · WordPress plugins & themes · reported by WPScanMedium 4.7
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025goodlayers-core: Does not sanitise and escape some of its settingsCVE-2024-11357 · WordPress plugins & themes · reported by WPScanMedium 5.9
The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- goodlayers-core
- Fixed in
- 2.0.10
- What to do
- Update goodlayers-core to 2.0.10 or newer.
Jan 2, 2025wp-enable-svg: Does not sanitize SVG filesCVE-2024-11184 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
- Product
- wp-enable-svg
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update wp-enable-svg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 1, 2025The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against higCVE-2024-11846 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Dec 31, 2024Category Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibnuyahya Category Post Shortcode category-post-shortcode allows Stored XSS.This issue affects Category Post Shortcode: from n/a through <= 2.4.
- Product
- Category Post Shortcode
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Category Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SvegliaT Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svegliadesign SvegliaT Buttons svegliat-buttons allows Stored XSS.This issue affects SvegliaT Buttons: from n/a through <= 1.3.0.
- Product
- SvegliaT Buttons
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update SvegliaT Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56063 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56062 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.987.
- Product
- Royal Elementor Addons
- Affected
- up to 1.3.987
- What to do
- Affects up to 1.3.987. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024EditionGuard for WooCommerce – eBook Sales with DRM: Cross-Site Request Forgery (CSRF)CVE-2024-56207 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Privilege Escalation.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.
- Product
- EditionGuard for WooCommerce – eBook Sales with DRM
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024gap-hub-user-role: Cross-Site Request Forgery (CSRF)CVE-2024-56206 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through <= 3.4.1.
- Product
- gap-hub-user-role
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update gap-hub-user-role to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Sinking Dropdowns: Cross-Site Request Forgery (CSRF)CVE-2024-56204 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through <= 1.25.
- Product
- Sinking Dropdowns
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update Sinking Dropdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Wayne Audio Player: Cross-Site Request Forgery (CSRF)CVE-2024-56203 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Player: from n/a through <= 1.0.
- Product
- Wayne Audio Player
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wayne Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Agency Toolkit: Missing AuthorizationCVE-2024-56066 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <= 1.0.23.
- Product
- Agency Toolkit
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Agency Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024RepairBuddy: Missing AuthorizationCVE-2024-56061 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through <= 3.8119.
- Product
- RepairBuddy
- Affected
- up to 3.8119
- What to do
- Affects up to 3.8119. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPLMS: Path Traversal: '.../...//'CVE-2024-56045 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.
- Product
- WPLMS
- Fixed in
- 1.9.9.5
- What to do
- Update WPLMS to 1.9.9.5 or newer.
Dec 31, 2024WPLMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-56044 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPLMS: Incorrect Privilege AssignmentCVE-2024-56043 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024VibeBP: Incorrect Privilege AssignmentCVE-2024-56040 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.
- Product
- VibeBP
- Affected
- up to 1.9.9.4.1
- What to do
- Affects up to 1.9.9.4.1. Update VibeBP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Contact Form, Survey & Form Builder – MightyForms: Missing AuthorizationCVE-2024-56002 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form, Survey & Form Builder – MightyForms: from n/a through <= 1.3.9.
- Product
- Contact Form, Survey & Form Builder – MightyForms
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Contact Form, Survey & Form Builder – MightyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Torod: Missing AuthorizationCVE-2024-55995 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Torod Company for Information Technology Torod torod allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Torod: from n/a through <= 1.7.
- Product
- Torod
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Torod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Paytium: Missing AuthorizationCVE-2024-51667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10.
- Product
- Paytium
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Best Restaurant Menu by PriceListo: Missing AuthorizationCVE-2024-49698 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto.This issue affects Best Restaurant Menu by PriceListo: from n/a through <= 1.4.2.
- Product
- Best Restaurant Menu by PriceListo
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Best Restaurant Menu by PriceListo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024My Wp Brand: Missing AuthorizationCVE-2024-49694 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in imw3 My Wp Brand my-wp-brand.This issue affects My Wp Brand: from n/a through <= 1.1.2.
- Product
- My Wp Brand
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update My Wp Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Smart Manager: Missing AuthorizationCVE-2024-49687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0.
- Product
- Smart Manager
- Affected
- up to 8.45.0
- What to do
- Affects up to 8.45.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Landing Page Cat: Missing AuthorizationCVE-2024-49686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in fatcatapps Landing Page Cat landing-page-cat.This issue affects Landing Page Cat: from n/a through <= 1.7.4.
- Product
- Landing Page Cat
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024AI Magic: Incorrect Privilege AssignmentCVE-2024-56205 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a through <= 1.0.4.
- Product
- AI Magic
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update AI Magic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Simple Dashboard: Incorrect Privilege AssignmentCVE-2024-56071 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboard: from n/a through <= 2.0.
- Product
- Simple Dashboard
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Simple Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Unrestricted Upload of File with Dangerous TypeCVE-2024-56064 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.