Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 48 of 94
Jan 2, 2025Highlight: Cross-Site Request Forgery (CSRF)CVE-2024-37458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Highlight highlight allows Cross Site Request Forgery.This issue affects Highlight: from n/a through <= 1.0.29.
- Product
- Highlight
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Highlight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Travel Agency: Cross-Site Request Forgery (CSRF)CVE-2024-37451 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Travel Agency travel-agency allows Cross Site Request Forgery.This issue affects Travel Agency: from n/a through <= 1.4.9.
- Product
- Travel Agency
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Travel Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Benevolent: Cross-Site Request Forgery (CSRF)CVE-2024-37450 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Benevolent benevolent allows Cross Site Request Forgery.This issue affects Benevolent: from n/a through <= 1.3.4.
- Product
- Benevolent
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Benevolent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025OnePress: Cross-Site Request Forgery (CSRF)CVE-2024-37448 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in famethemes OnePress onepress allows Cross Site Request Forgery.This issue affects OnePress: from n/a through <= 2.3.6.
- Product
- OnePress
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update OnePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025NewsMash: Cross-Site Request Forgery (CSRF)CVE-2024-37441 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in desertthemes NewsMash newsmash allows Cross Site Request Forgery.This issue affects NewsMash: from n/a through <= 1.0.34.
- Product
- NewsMash
- Affected
- up to 1.0.34
- What to do
- Affects up to 1.0.34. Update NewsMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Perfect Portfolio: Cross-Site Request Forgery (CSRF)CVE-2024-37435 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Cross Site Request Forgery.This issue affects Perfect Portfolio: from n/a through <= 1.2.0.
- Product
- Perfect Portfolio
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Mesmerize: Cross-Site Request Forgery (CSRF)CVE-2024-37431 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Mesmerize mesmerize allows Cross Site Request Forgery.This issue affects Mesmerize: from n/a through <= 1.6.120.
- Product
- Mesmerize
- Affected
- up to 1.6.120
- What to do
- Affects up to 1.6.120. Update Mesmerize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Elegant Pink: Cross-Site Request Forgery (CSRF)CVE-2024-37426 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Elegant Pink elegant-pink allows Cross Site Request Forgery.This issue affects Elegant Pink: from n/a through <= 1.3.0.
- Product
- Elegant Pink
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025JobScout: Cross-Site Request Forgery (CSRF)CVE-2024-37421 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme JobScout jobscout allows Cross Site Request Forgery.This issue affects JobScout: from n/a through <= 1.1.4.
- Product
- JobScout
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update JobScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Coachify: Cross-Site Request Forgery (CSRF)CVE-2024-37417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.0.7.
- Product
- Coachify
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Coachify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Preschool and Kindergarten: Cross-Site Request Forgery (CSRF)CVE-2024-37413 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Cross Site Request Forgery.This issue affects Preschool and Kindergarten: from n/a through <= 1.2.1.
- Product
- Preschool and Kindergarten
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Preschool and Kindergarten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Blossom Shop: Cross-Site Request Forgery (CSRF)CVE-2024-37412 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.
- Product
- Blossom Shop
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Blossom Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Mobile Menu: Cross-Site Request Forgery (CSRF)CVE-2024-37274 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rui Guerreiro WP Mobile Menu mobile-menu allows Cross Site Request Forgery.This issue affects WP Mobile Menu: from n/a through <= 2.8.4.3.
- Product
- WP Mobile Menu
- Affected
- up to 2.8.4.3
- What to do
- Affects up to 2.8.4.3. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Travel Monster: Cross-Site Request Forgery (CSRF)CVE-2024-37272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.
- Product
- Travel Monster
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Travel Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Vandana Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vandana Lite vandana-lite allows Cross Site Request Forgery.This issue affects Vandana Lite: from n/a through <= 1.1.9.
- Product
- Vandana Lite
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Vandana Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Newspack Newsletters: Cross-Site Request Forgery (CSRF)CVE-2024-37242 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through <= 2.13.2.
- Product
- Newspack Newsletters
- Affected
- up to 2.13.2
- What to do
- Affects up to 2.13.2. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Falang multilanguage: Cross-Site Request Forgery (CSRF)CVE-2024-37240 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.51.
- Product
- Falang multilanguage
- Affected
- up to 1.3.51
- What to do
- Affects up to 1.3.51. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WPAdverts: Cross-Site Request Forgery (CSRF)CVE-2024-37238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Greg Winiarski WPAdverts wpadverts allows Cross Site Request Forgery.This issue affects WPAdverts: from n/a through <= 2.1.2.
- Product
- WPAdverts
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Loco Translate: Cross-Site Request Forgery (CSRF)CVE-2024-37236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tim W Loco Translate loco-translate allows Cross Site Request Forgery.This issue affects Loco Translate: from n/a through <= 2.6.9.
- Product
- Loco Translate
- Affected
- up to 2.6.9
- What to do
- Affects up to 2.6.9. Update Loco Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Groundhogg: Cross-Site Request Forgery (CSRF)CVE-2024-37235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Tobey Groundhogg groundhogg allows Cross Site Request Forgery.This issue affects Groundhogg: from n/a through <= 3.4.2.3.
- Product
- Groundhogg
- Affected
- up to 3.4.2.3
- What to do
- Affects up to 3.4.2.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Chic Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37104 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Chic Lite chic-lite allows Cross Site Request Forgery.This issue affects Chic Lite: from n/a through <= 1.1.3.
- Product
- Chic Lite
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Chic Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Education Zone: Cross-Site Request Forgery (CSRF)CVE-2024-37103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Education Zone education-zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through <= 1.3.4.
- Product
- Education Zone
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Education Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Vilva: Cross-Site Request Forgery (CSRF)CVE-2024-37102 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vilva vilva allows Cross Site Request Forgery.This issue affects Vilva: from n/a through <= 1.2.2.
- Product
- Vilva
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Vilva to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025MasterStudy LMS: Cross-Site Request Forgery (CSRF)CVE-2024-37093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.
- Product
- MasterStudy LMS
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025AHAthat: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-12595 · WordPress plugins & themes · reported by WPScanMedium 4.7
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024EditionGuard for WooCommerce – eBook Sales with DRM: Cross-Site Request Forgery (CSRF)CVE-2024-56207 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Privilege Escalation.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.
- Product
- EditionGuard for WooCommerce – eBook Sales with DRM
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024gap-hub-user-role: Cross-Site Request Forgery (CSRF)CVE-2024-56206 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through <= 3.4.1.
- Product
- gap-hub-user-role
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update gap-hub-user-role to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Sinking Dropdowns: Cross-Site Request Forgery (CSRF)CVE-2024-56204 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through <= 1.25.
- Product
- Sinking Dropdowns
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update Sinking Dropdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Wayne Audio Player: Cross-Site Request Forgery (CSRF)CVE-2024-56203 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Player: from n/a through <= 1.0.
- Product
- Wayne Audio Player
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wayne Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP Nice Loader: Cross-Site Request Forgery (CSRF)CVE-2024-56232 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a through <= 0.1.0.4.
- Product
- WP Nice Loader
- Affected
- up to 0.1.0.4
- What to do
- Affects up to 0.1.0.4. Update WP Nice Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SearchIQ: Cross-Site Request Forgery (CSRF)CVE-2024-56229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SearchIQ SearchIQ searchiq.This issue affects SearchIQ: from n/a through <= 4.6.
- Product
- SearchIQ
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024CodeBard Help Desk: Cross-Site Request Forgery (CSRF)CVE-2024-56222 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Cross Site Request Forgery.This issue affects CodeBard Help Desk: from n/a through <= 1.1.1.
- Product
- CodeBard Help Desk
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Contact Form 7 – Dynamic Text Extension: Cross-Site Request Forgery (CSRF)CVE-2024-56218 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site Request Forgery.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through <= 5.0.1.
- Product
- Contact Form 7 – Dynamic Text Extension
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update Contact Form 7 – Dynamic Text Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2024Broken Link Checker: Does not validate a the link URLs before making a request to themCVE-2024-10903 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
- Product
- Broken Link Checker
- Fixed in
- 2.4.2
- What to do
- Update Broken Link Checker to 2.4.2 or newer.
Dec 25, 2024Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Cross-Site Request ForgeryCVE-2024-12636 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.6. This is due to missing or incorrect nonce validation on the 'create_popup_delete_process' function. This makes it possible for unauthenticated attackers to delete popups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 21, 2024eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2024-12771 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- eCommerce Product Catalog Plugin for
- Affected
- up to 3.3.43
- What to do
- Affects up to 3.3.43. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2024Wtyczka SeoPilot dla WP: Cross-Site Request ForgeryCVE-2024-11812 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to missing or incorrect nonce validation on the SeoPilot_Admin_Options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Wtyczka SeoPilot dla WP
- Affected
- up to 3.3.091
- What to do
- Affects up to 3.3.091. Update Wtyczka SeoPilot dla WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024Broken Link Checker | Finder: Blind Server-Side Request ForgeryCVE-2024-12121 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024Peter’s Custom Anti-Spam: Cross-Site Request ForgeryCVE-2024-12554 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on the cas_register_post() function. This makes it possible for unauthenticated attackers to blacklist emails via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Peter’s Custom Anti-Spam
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Peter’s Custom Anti-Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2024Affiliate Program Suite — SliceWP Affiliates: Cross-Site Request ForgeryCVE-2024-12454 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Affiliate Program Suite — SliceWP Affiliates
- Affected
- up to 1.1.23
- What to do
- Affects up to 1.1.23. Update Affiliate Program Suite — SliceWP Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 17, 2024User Role Editor: Cross-Site Request ForgeryCVE-2024-12293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the update_roles() function. This makes it possible for unauthenticated attackers to add or remove roles for arbitrary users, including escalating their privileges to administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- User Role Editor
- Affected
- up to 4.64.3
- What to do
- Affects up to 4.64.3. Update User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 17, 2024SMS for WooCommerce: Cross-Site Request ForgeryCVE-2024-12220 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- SMS for WooCommerce
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update SMS for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 17, 2024Stop Registration Spam: Cross-Site Request ForgeryCVE-2024-12219 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-56017 is likely a duplicate of this issue.
- Product
- Stop Registration Spam
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 17, 2024WP All Import Pro: Server-Side Request ForgeryCVE-2024-9624 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.
- Product
- WP All Import Pro
- Affected
- up to 4.9.3
- What to do
- Affects up to 4.9.3. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpallimport.com
Dec 16, 2024Stop Registration Spam: Cross-Site Request Forgery (CSRF)CVE-2024-56017 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23.
- Product
- Stop Registration Spam
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Avada: Cross-Site Request Forgery (CSRF)CVE-2024-54357 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.
- Product
- Avada
- Affected
- up to 7.11.10
- What to do
- Affects up to 7.11.10. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Tidy Up: Cross-Site Request Forgery (CSRF)CVE-2024-56015 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3.
- Product
- Tidy Up
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Tidy Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Flash News / Post (Responsive): Cross-Site Request Forgery (CSRF)CVE-2024-56012 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.
- Product
- Flash News / Post (Responsive)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flash News / Post (Responsive) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Posti Shipping: Cross-Site Request Forgery (CSRF)CVE-2024-56005 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: from n/a through <= 3.10.3.
- Product
- Posti Shipping
- Affected
- up to 3.10.3
- What to do
- Affects up to 3.10.3. Update Posti Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP-Ban-User: Cross-Site Request Forgery (CSRF)CVE-2024-54440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0.
- Product
- WP-Ban-User
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP-Ban-User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.