Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,417 results · page 470 of 829
Dec 13, 2024FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54246 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.
- Product
- FAQs
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.
- Product
- Clients
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.
- Product
- Easy Replace
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Easy Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Echoza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.
- Product
- Echoza
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update Echoza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple Notification: Missing AuthorizationCVE-2024-54242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.
- Product
- Simple Notification
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Simple Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: Missing AuthorizationCVE-2024-54241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.
- Product
- Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification
- What to do
- Update Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification to the newest version.
Dec 13, 2024Blaze Online eParcel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.
- Product
- Blaze Online eParcel for WooCommerce
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Blaze Online eParcel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Eyewear prescription form: Missing AuthorizationCVE-2024-54239 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.
- Product
- Eyewear prescription form
- Affected
- up to 4.0.18
- What to do
- Affects up to 4.0.18. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.
- Product
- Board Document Manager from CHUHPL
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
- Product
- Ni CRM Lead
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ni WooCommerce Bulk Product Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.
- Product
- Ni WooCommerce Bulk Product Editor
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Ni WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Shiptimize for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.86.
- Product
- Shiptimize for WooCommerce
- Affected
- up to 3.1.86
- What to do
- Affects up to 3.1.86. Update Shiptimize for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54234 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
- Product
- Limit Login Attempts
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
- Product
- Advanced Control Manager for WordPress by ItalyStrap
- Affected
- up to 2.16.0
- What to do
- Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ni WooCommerce Order Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54231 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-order-export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through <= 3.1.6.
- Product
- Ni WooCommerce Order Export
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Ni WooCommerce Order Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Brands for WooCommerce: Missing AuthorizationCVE-2023-44149 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through <= 3.8.2.2.
- Product
- Brands for WooCommerce
- Affected
- up to 3.8.2.2
- What to do
- Affects up to 3.8.2.2. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Comment Blacklist Updater: Missing AuthorizationCVE-2023-44147 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through <= 1.1.0.
- Product
- Comment Blacklist Updater
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Comment Blacklist Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Inactive Logout: Missing AuthorizationCVE-2023-44142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Deepen Bajracharya Inactive Logout inactive-logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through <= 3.2.2.
- Product
- Inactive Logout
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Inactive Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024FluentForm: Missing AuthorizationCVE-2023-41952 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8.
- Product
- FluentForm
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024rtMedia for WordPress, BuddyPress and bbPress: Missing AuthorizationCVE-2023-41951 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Affected
- up to 4.6.14
- What to do
- Affects up to 4.6.14. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Directory Kit: Missing AuthorizationCVE-2023-41875 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.
- Product
- WP Directory Kit
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024SAML SP Single Sign On: Missing AuthorizationCVE-2023-41873 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.
- Product
- SAML SP Single Sign On
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update SAML SP Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Crowdfunding: Missing AuthorizationCVE-2023-41870 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Accessibility Helper (WAH): Missing AuthorizationCVE-2023-41869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4.
- Product
- WP Accessibility Helper (WAH)
- Affected
- up to 0.6.2.4
- What to do
- Affects up to 0.6.2.4. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Automatic YouTube Gallery: Missing AuthorizationCVE-2023-41866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3.
- Product
- Automatic YouTube Gallery
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Automatic YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Slider Pro: Missing AuthorizationCVE-2023-41865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.
- Product
- Slider Pro
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024VS Contact Form: Weak AuthenticationCVE-2023-41862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0.
- Product
- VS Contact Form
- Affected
- up to 14.0
- What to do
- Affects up to 14.0. Update VS Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Click To Tweet: Missing AuthorizationCVE-2023-41857 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ClickToTweet.com Click To Tweet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Click To Tweet: from n/a through 2.0.14.
- Product
- Click To Tweet
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update Click To Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Posts Like Dislike: Missing AuthorizationCVE-2023-41849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Like Dislike: from n/a through 1.1.0.
- Product
- Posts Like Dislike
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Posts Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Carousel Slider: Missing AuthorizationCVE-2023-41848 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carousel Slider: from n/a through 2.2.2.
- Product
- Carousel Slider
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024BitPay Checkout for WooCommerce: Missing AuthorizationCVE-2023-41803 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0.
- Product
- BitPay Checkout for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update BitPay Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Super Socializer: Missing AuthorizationCVE-2023-41802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54.
- Product
- Super Socializer
- Affected
- up to 7.13.54
- What to do
- Affects up to 7.13.54. Update Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Analytify: Missing AuthorizationCVE-2023-41695 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.1.0.
- Product
- Analytify
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WiserNotify Social Proof: Missing AuthorizationCVE-2023-41690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wiser Notify WiserNotify Social Proof allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserNotify Social Proof: from n/a through 2.5.
- Product
- WiserNotify Social Proof
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update WiserNotify Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Post to Google My Business (Google Business Profile): Missing AuthorizationCVE-2023-41689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.
- Product
- Post to Google My Business (Google Business Profile)
- Affected
- up to 3.1.14
- What to do
- Affects up to 3.1.14. Update Post to Google My Business (Google Business Profile) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Bulk NoIndex & NoFollow Toolkit: Missing AuthorizationCVE-2023-41688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through 1.5.
- Product
- Bulk NoIndex & NoFollow Toolkit
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Woocommerce Support System: Cross-Site Request Forgery (CSRF)CVE-2023-41686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2.
- Product
- Woocommerce Support System
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Woocommerce Support System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024TelSender: Missing AuthorizationCVE-2023-41683 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Pechenki TelSender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TelSender: from n/a through 1.14.11.
- Product
- TelSender
- Affected
- up to 1.14.11
- What to do
- Affects up to 1.14.11. Update TelSender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Abandoned Cart Lite for WooCommerce: Missing AuthorizationCVE-2023-41671 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in tychesoftwares Abandoned Cart Lite for WooCommerce woocommerce-abandoned-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Cart Lite for WooCommerce: from n/a through <= 5.16.1.
- Product
- Abandoned Cart Lite for WooCommerce
- Affected
- up to 5.16.1
- What to do
- Affects up to 5.16.1. Update Abandoned Cart Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Newsletter Signups: Missing AuthorizationCVE-2023-41664 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AlphaBPO Easy Newsletter Signups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Newsletter Signups: from n/a through 1.0.4.
- Product
- Easy Newsletter Signups
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ovic Product Bundle: Missing AuthorizationCVE-2023-41649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ovic Team Ovic Product Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovic Product Bundle: from n/a through 1.1.2.
- Product
- Ovic Product Bundle
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ovic Product Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Secure Admin IP: Authentication Bypass by SpoofingCVE-2023-41133 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Michal Novák Secure Admin IP allows Functionality Bypass.This issue affects Secure Admin IP: from n/a through 2.0.
- Product
- Secure Admin IP
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Secure Admin IP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Category Slider for WooCommerce: Missing AuthorizationCVE-2023-41132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ShapedPlugin LLC Category Slider for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Category Slider for WooCommerce: from n/a through 1.4.15.
- Product
- Category Slider for WooCommerce
- Affected
- up to 1.4.15
- What to do
- Affects up to 1.4.15. Update Category Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Premmerce User Roles: Missing AuthorizationCVE-2023-41130 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.12.
- Product
- Premmerce User Roles
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple URLs: Missing AuthorizationCVE-2023-40678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Andrew Fiebert Simple URLs simple-urls allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through <= 117.
- Product
- Simple URLs
- Affected
- up to 117
- What to do
- Affects up to 117. Update Simple URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ReviewX: Missing AuthorizationCVE-2023-40670 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ReviewX Team ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.17.
- Product
- ReviewX
- Affected
- up to 1.6.17
- What to do
- Affects up to 1.6.17. Update ReviewX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024HUSKY: Missing AuthorizationCVE-2023-40334 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 HUSKY woocommerce-products-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HUSKY: from n/a through <= 1.3.4.2.
- Product
- HUSKY
- Affected
- up to 1.3.4.2
- What to do
- Affects up to 1.3.4.2. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Accordion Slider: Missing AuthorizationCVE-2023-40331 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider: from n/a through 1.9.6.
- Product
- Accordion Slider
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Justified Gallery: Missing AuthorizationCVE-2023-40213 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mateusz Czardybon Justified Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justified Gallery: from n/a through 1.7.3.
- Product
- Justified Gallery
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Justified Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024MailChimp Forms by MailMunch: Missing AuthorizationCVE-2023-40203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4.
- Product
- MailChimp Forms by MailMunch
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.