Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,442 results · page 478 of 829
Dec 9, 2024Japanized For WooCommerce: Missing AuthorizationCVE-2023-47698 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.4.
- Product
- Japanized For WooCommerce
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Mini Cart Drawer For WooCommerce: Missing AuthorizationCVE-2023-47694 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.
- Product
- Mini Cart Drawer For WooCommerce
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Mini Cart Drawer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Ni WooCommerce Sales Report: Missing AuthorizationCVE-2023-32299 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Sales Report ni-woocommerce-sales-report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through <= 3.7.3.
- Product
- Ni WooCommerce Sales Report
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Ni WooCommerce Sales Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WRC Pricing Tables: Missing AuthorizationCVE-2023-32293 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7.
- Product
- WRC Pricing Tables
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update WRC Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024SALERT: Missing AuthorizationCVE-2023-32126 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPoperation SALERT allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALERT: from n/a through 1.2.1.
- Product
- SALERT
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update SALERT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-32117 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.
- Product
- Integrate Google Drive
- Affected
- up to 1.1.99
- What to do
- Affects up to 1.1.99. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Extended Post Status: Missing AuthorizationCVE-2023-32094 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.
- Product
- Extended Post Status
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Extended Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Quick Post Duplicator: Missing AuthorizationCVE-2023-31214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0.
- Product
- WP Quick Post Duplicator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
- Product
- Display custom fields in the frontend – Post and User Profile Fields
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Docs: Missing AuthorizationCVE-2023-30873 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.
- Product
- WP Docs
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sharkdropship for AliExpress Dropship and Affiliate: Missing AuthorizationCVE-2023-30870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3.
- Product
- Sharkdropship for AliExpress Dropship and Affiliate
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Sharkdropship for AliExpress Dropship and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Smart WooCommerce Search: Missing AuthorizationCVE-2023-30783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.
- Product
- Smart WooCommerce Search
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Smart WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-30748 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7.
- Product
- Easy Appointments
- Affected
- up to 3.10.7
- What to do
- Affects up to 3.10.7. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Featured Post Creative: Missing AuthorizationCVE-2023-30488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.
- Product
- Featured Post Creative
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Square: Missing AuthorizationCVE-2023-30486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.
- Product
- Square
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stamped.io Product Reviews & UGC for WooCommerce: Missing AuthorizationCVE-2023-30479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.3.2.
- Product
- Stamped.io Product Reviews & UGC for WooCommerce
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Stamped.io Product Reviews & UGC for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
- Product
- Blogger Buzz
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024tencentcloud-cos: Missing AuthorizationCVE-2023-29433 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 腾讯云 tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7.
- Product
- tencentcloud-cos
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update tencentcloud-cos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024qTranslate X Cleanup and WPML Import: Missing AuthorizationCVE-2023-29431 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1.
- Product
- qTranslate X Cleanup and WPML Import
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update qTranslate X Cleanup and WPML Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024User Registration: Missing AuthorizationCVE-2023-29429 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 2.3.2.1.
- Product
- User Registration
- Affected
- up to 2.3.2.1
- What to do
- Affects up to 2.3.2.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Dynamics 365 Integration: Missing AuthorizationCVE-2023-29422 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13.
- Product
- Dynamics 365 Integration
- Affected
- up to 1.3.13
- What to do
- Affects up to 1.3.13. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024LuckyWP Scripts Control: Missing AuthorizationCVE-2023-29239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1.
- Product
- LuckyWP Scripts Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update LuckyWP Scripts Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Remove Duplicate Posts: Missing AuthorizationCVE-2023-29237 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5.
- Product
- Remove Duplicate Posts
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Remove Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Category Tree: Missing AuthorizationCVE-2023-29173 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.
- Product
- Product Category Tree
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Product Category Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024JS Job Manager: Missing AuthorizationCVE-2023-28689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.
- Product
- JS Job Manager
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024TH Variation Swatches: Cross-Site Request Forgery (CSRF)CVE-2023-28688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
- Product
- TH Variation Swatches
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update TH Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Branded Social Images: Missing AuthorizationCVE-2023-28536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.
- Product
- Branded Social Images
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Branded Social Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Real Estate Directory: Missing AuthorizationCVE-2023-28532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5.
- Product
- Real Estate Directory
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Dynamics 365 Integration: Missing AuthorizationCVE-2023-28417 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.
- Product
- Dynamics 365 Integration
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Chankhe: Missing AuthorizationCVE-2023-28416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5.
- Product
- Chankhe
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Chankhe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Console: Missing AuthorizationCVE-2023-28168 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9.
- Product
- WordPress Console
- Affected
- up to 0.3.9
- What to do
- Affects up to 0.3.9. Update WordPress Console to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Backup Bank: WordPress Backup: Missing AuthorizationCVE-2023-28165 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: from n/a through 4.0.28.
- Product
- Backup Bank: WordPress Backup
- Affected
- up to 4.0.28
- What to do
- Affects up to 4.0.28. Update Backup Bank: WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stock Ticker: Missing AuthorizationCVE-2023-27626 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aleksandar Urošević Stock Ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Ticker: from n/a through 3.23.0.
- Product
- Stock Ticker
- Affected
- up to 3.23.0
- What to do
- Affects up to 3.23.0. Update Stock Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Site Reviews: Missing AuthorizationCVE-2023-27625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.5.0.
- Product
- Site Reviews
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Rife Elementor Extensions & Templates: Missing AuthorizationCVE-2023-27454 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.
- Product
- Rife Elementor Extensions & Templates
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Total Poll Lite: Missing AuthorizationCVE-2023-27449 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through 4.8.6.
- Product
- Total Poll Lite
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP users media: Missing AuthorizationCVE-2023-27428 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP users media: from n/a through 4.2.3.
- Product
- WP users media
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WP users media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Repost: Missing AuthorizationCVE-2023-26522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1.
- Product
- WP Repost
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP Repost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Advanced Text Widget: Missing AuthorizationCVE-2023-26520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2.
- Product
- Advanced Text Widget
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Advanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Top 10: Missing AuthorizationCVE-2023-25993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: from n/a through 3.2.3.
- Product
- Top 10
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Top 10 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Filebird: Missing AuthorizationCVE-2023-25966 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.
- Product
- Filebird
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Apollo13 Framework Extensions: Missing AuthorizationCVE-2023-25959 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.8.10
- What to do
- Affects up to 1.8.10. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fontiran: Missing AuthorizationCVE-2023-25791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran: from n/a through 2.1.
- Product
- Fontiran
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Fontiran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Paypal Payments: Missing AuthorizationCVE-2023-25714 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
- Product
- Quick Paypal Payments
- Affected
- up to 5.7.25
- What to do
- Affects up to 5.7.25. Update Quick Paypal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Meta slider and carousel with lightbox: Missing AuthorizationCVE-2023-25703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2.
- Product
- Meta slider and carousel with lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Clone: Missing AuthorizationCVE-2023-25486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7.
- Product
- Clone
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Table of Contents: Missing AuthorizationCVE-2023-25469 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2.
- Product
- Easy Table of Contents
- Affected
- up to 2.0.45.2
- What to do
- Affects up to 2.0.45.2. Update Easy Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-25455 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Protected Posts Logout Button: Missing AuthorizationCVE-2023-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5.
- Product
- Protected Posts Logout Button
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Protected Posts Logout Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024We’re Open!: Missing AuthorizationCVE-2023-25067 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Noah Hearle, Design Extreme We’re Open! allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects We’re Open!: from n/a through 1.45.
- Product
- We’re Open!
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update We’re Open! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.