Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 47 of 94
Jan 7, 2025Envato Elements: Server-Side Request Forgery (SSRF)CVE-2024-56275 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a through 2.0.14.
- Product
- Envato Elements
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update Envato Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Bus Ticket Booking with Seat Reservation: Cross-Site Request Forgery (CSRF)CVE-2024-49294 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Cross Site Request Forgery.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.4.3.
- Product
- Bus Ticket Booking with Seat Reservation
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Binary MLM Woocommerce: Cross-Site Request ForgeryCVE-2024-12383 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmw_display_pv_set_page' function and insufficient input sanitization and output escaping of the 'product_points' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Binary MLM Woocommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Binary MLM Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025ThePerfectWedding.nl Widget: Cross-Site Request ForgeryCVE-2024-12322 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to missing or incorrect nonce validation on the 'update_option' function. This makes it possible for unauthenticated attackers to update the 'tpwKey' option with stored cross-site scripting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ThePerfectWedding.nl Widget
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update ThePerfectWedding.nl Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025ViewMedica 9: Cross-Site Request ForgeryCVE-2024-12291 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.17. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ViewMedica 9
- Affected
- up to 1.4.17
- What to do
- Affects up to 1.4.17. Update ViewMedica 9 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 7, 2025Simple add pages or posts: Cross-Site Request ForgeryCVE-2024-12288 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple add pages or posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Simple add pages or posts
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Simple add pages or posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 7, 2025ViewMedica 9: Cross-Site Request ForgeryCVE-2024-12170 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15. This is due to missing or incorrect nonce validation on the 'Viewmedica-Admin' page. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ViewMedica 9
- Affected
- up to 1.4.15
- What to do
- Affects up to 1.4.15. Update ViewMedica 9 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 6, 2025Transporters.io: Cross-Site Request ForgeryCVE-2024-12557 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Transporters.io
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Transporters.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 6, 2025Chative Live chat and Chatbot: Cross-Site Request ForgeryCVE-2024-12541 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Chative Live chat and Chatbot plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the add_chative_widget_action() function. This makes it possible for unauthenticated attackers to change the channel ID or organization ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This could lead to redirecting the live chat widget to an attacker-controlled channel.
- Product
- Chative Live chat and Chatbot
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Chative Live chat and Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 4, 2025WP Social AutoConnect: Cross-Site Request ForgeryCVE-2024-12279 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Social AutoConnect
- Affected
- up to 4.6.2
- What to do
- Affects up to 4.6.2. Update WP Social AutoConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 4, 2025Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more: Cross-Site Request ForgeryCVE-2024-12545 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 3, 2025Photo Gallery Slideshow & Masonry Tiled Gallery: Server-Side Request ForgeryCVE-2024-12237 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services.
- Product
- Photo Gallery Slideshow & Masonry Tiled Gallery
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025Patricia Blog: Cross-Site Request Forgery (CSRF)CVE-2024-38732 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through 1.2.
- Product
- Patricia Blog
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Patricia Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025i-amaze: Cross-Site Request Forgery (CSRF)CVE-2024-38731 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7.
- Product
- i-amaze
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update i-amaze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Point: Cross-Site Request Forgery (CSRF)CVE-2024-37931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1.
- Product
- Point
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Point to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025BuddyBoss: Cross-Site Request Forgery (CSRF)CVE-2024-37925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a through 2.4.61.
- Product
- BuddyBoss
- Affected
- up to 2.4.61
- What to do
- Affects up to 2.4.61. Update BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Schema Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37452 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop Schema Lite allows Cross Site Request Forgery.This issue affects Schema Lite: from n/a through 1.2.2.
- Product
- Schema Lite
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Schema Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Uncanny Toolkit Pro for LearnDash: Cross-Site Request Forgery (CSRF)CVE-2024-37438 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.
- Product
- Uncanny Toolkit Pro for LearnDash
- Fixed in
- 4.1.4.1
- What to do
- Update Uncanny Toolkit Pro for LearnDash to 4.1.4.1 or newer.
Jan 2, 2025WP Job Manager - Resume Manager: Cross-Site Request Forgery (CSRF)CVE-2024-37241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
- Product
- WP Job Manager - Resume Manager
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025FS Poster: Cross-Site Request Forgery (CSRF)CVE-2024-37237 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in fs-code FS Poster fs-poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through <= 6.5.8.
- Product
- FS Poster
- Affected
- up to 6.5.8
- What to do
- Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025ListingPro: Cross-Site Request Forgery (CSRF)CVE-2024-39623 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2024-38778 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.69.234.
- Product
- WP Fast Total Search
- Affected
- up to 1.69.234
- What to do
- Affects up to 1.69.234. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025i-transform: Cross-Site Request Forgery (CSRF)CVE-2024-38764 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9.
- Product
- i-transform
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update i-transform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Event Espresso 4 Decaf: Cross-Site Request Forgery (CSRF)CVE-2024-56251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.28.decaf.
- Product
- Event Espresso 4 Decaf
- Affected
- up to 5.0.28.decaf
- What to do
- Affects up to 5.0.28.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Email Address Encoder: Cross-Site Request Forgery (CSRF)CVE-2024-43927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through <= 1.0.23.
- Product
- Email Address Encoder
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Smartsupp – live chat, chatbots, AI and lead generation: Cross-Site Request Forgery (CSRF)CVE-2024-38790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.
- Product
- Smartsupp – live chat, chatbots, AI and lead generation
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Smartsupp – live chat, chatbots, AI and lead generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Telegram Bot & Channel: Cross-Site Request Forgery (CSRF)CVE-2024-38789 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through <= 3.8.2.
- Product
- Telegram Bot & Channel
- Affected
- up to 3.8.2
- What to do
- Affects up to 3.8.2. Update Telegram Bot & Channel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Matomo Analytics: Cross-Site Request Forgery (CSRF)CVE-2024-38766 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in matomoteam Matomo Analytics matomo allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through <= 5.1.1.
- Product
- Matomo Analytics
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Matomo Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Oceanic: Cross-Site Request Forgery (CSRF)CVE-2024-38765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in outtheboxthemes Oceanic oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a through <= 1.0.48.
- Product
- Oceanic
- Affected
- up to 1.0.48
- What to do
- Affects up to 1.0.48. Update Oceanic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Popularis Verse: Cross-Site Request Forgery (CSRF)CVE-2024-38763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through <= 1.1.1.
- Product
- Popularis Verse
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Popularis Verse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Event Tickets: Cross-Site Request Forgery (CSRF)CVE-2024-38762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through <= 5.11.0.4.
- Product
- Event Tickets
- Affected
- up to 5.11.0.4
- What to do
- Affects up to 5.11.0.4. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Taggbox: Cross-Site Request Forgery (CSRF)CVE-2024-38754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Taggbox Taggbox taggbox-widget allows Cross Site Request Forgery.This issue affects Taggbox: from n/a through <= 3.3.
- Product
- Taggbox
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Animated Rotating Words: Cross-Site Request Forgery (CSRF)CVE-2024-38753 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Cross Site Request Forgery.This issue affects Animated Rotating Words: from n/a through <= 5.6.
- Product
- Animated Rotating Words
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Google Adsense & Banner Ads by AdsforWP: Cross-Site Request Forgery (CSRF)CVE-2024-38751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Magazine3 Google Adsense & Banner Ads by AdsforWP ads-for-wp allows Cross Site Request Forgery.This issue affects Google Adsense & Banner Ads by AdsforWP: from n/a through <= 1.9.28.
- Product
- Google Adsense & Banner Ads by AdsforWP
- Affected
- up to 1.9.28
- What to do
- Affects up to 1.9.28. Update Google Adsense & Banner Ads by AdsforWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025MBE eShip: Cross-Site Request Forgery (CSRF)CVE-2024-38729 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in mbeelink MBE eShip mail-boxes-etc allows Cross Site Request Forgery.This issue affects MBE eShip: from n/a through <= 2.1.2.
- Product
- MBE eShip
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update MBE eShip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Metorik – Reports & Email Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-38691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through <= 1.7.1.
- Product
- Metorik – Reports & Email Automation for WooCommerce
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Metorik – Reports & Email Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Rara Business: Cross-Site Request Forgery (CSRF)CVE-2024-37937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Rara Business rara-business allows Cross Site Request Forgery.This issue affects Rara Business: from n/a through <= 1.2.5.
- Product
- Rara Business
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Rara Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Ultimate Auction: Cross-Site Request Forgery (CSRF)CVE-2024-37543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through <= 4.2.5.
- Product
- Ultimate Auction
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update Ultimate Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Leaky Paywall: Cross-Site Request Forgery (CSRF)CVE-2024-37540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through <= 4.21.2.
- Product
- Leaky Paywall
- Affected
- up to 4.21.2
- What to do
- Affects up to 4.21.2. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-37518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.5.1.4.
- Product
- The Events Calendar
- Affected
- up to 6.5.1.4
- What to do
- Affects up to 6.5.1.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Swift Performance Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.
- Product
- Swift Performance Lite
- Affected
- up to 2.3.6.20
- What to do
- Affects up to 2.3.6.20. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Construction Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37508 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through <= 1.3.5.
- Product
- Construction Landing Page
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Lawyer Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37503 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Cross Site Request Forgery.This issue affects Lawyer Landing Page: from n/a through <= 1.2.4.
- Product
- Lawyer Landing Page
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Lawyer Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Posterity: Cross-Site Request Forgery (CSRF)CVE-2024-37493 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Posterity posterity allows Cross Site Request Forgery.This issue affects Posterity: from n/a through <= 3.3.
- Product
- Posterity
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Posterity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Rife Free: Cross-Site Request Forgery (CSRF)CVE-2024-37491 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apollo13themes Rife Free rife-free allows Cross Site Request Forgery.This issue affects Rife Free: from n/a through <= 2.4.18.
- Product
- Rife Free
- Affected
- up to 2.4.18
- What to do
- Affects up to 2.4.18. Update Rife Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Bard: Cross-Site Request Forgery (CSRF)CVE-2024-37490 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wproyal Bard bard allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 2.210.
- Product
- Bard
- Affected
- up to 2.210
- What to do
- Affects up to 2.210. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Ashe: Cross-Site Request Forgery (CSRF)CVE-2024-37478 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wproyal Ashe ashe allows Cross Site Request Forgery.This issue affects Ashe: from n/a through <= 2.233.
- Product
- Ashe
- Affected
- up to 2.233
- What to do
- Affects up to 2.233. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Trendy News: Cross-Site Request Forgery (CSRF)CVE-2024-37473 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Trendy News trendy-news allows Cross Site Request Forgery.This issue affects Trendy News: from n/a through <= 1.0.15.
- Product
- Trendy News
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Trendy News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Blocksy: Cross-Site Request Forgery (CSRF)CVE-2024-37469 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through <= 2.0.22.
- Product
- Blocksy
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Hestia: Cross-Site Request Forgery (CSRF)CVE-2024-37467 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themeisle Hestia hestia allows Cross Site Request Forgery.This issue affects Hestia: from n/a through <= 3.1.2.
- Product
- Hestia
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Hestia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.