Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 50 of 94
Dec 16, 2024Sogrid: Cross-Site Request Forgery (CSRF)CVE-2024-54352 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Sabri Sogrid sogrid allows Privilege Escalation.This issue affects Sogrid: from n/a through <= 1.5.2.
- Product
- Sogrid
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Currency Exchange Rates: Cross-Site Request Forgery (CSRF)CVE-2024-54332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory WP Currency Exchange Rates wp-currency-exchange-rates allows Stored XSS.This issue affects WP Currency Exchange Rates: from n/a through <= 1.2.0.
- Product
- WP Currency Exchange Rates
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WP Currency Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024I Plant A Tree: Cross-Site Request Forgery (CSRF)CVE-2024-54331 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through <= 1.7.3.
- Product
- I Plant A Tree
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update I Plant A Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Advanced Custom Fields PRO: Cross-Site Request Forgery (CSRF)CVE-2024-37251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.
- Product
- Advanced Custom Fields PRO
- Fixed in
- 6.3.2
- What to do
- Update Advanced Custom Fields PRO to 6.3.2 or newer.
Dec 14, 2024SIP Calculator: Cross-Site Request ForgeryCVE-2024-12555 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SIP Calculator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- SIP Calculator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SIP Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 13, 2024Fancy Roller Scroller: Cross-Site Request Forgery (CSRF)CVE-2024-54351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Thomas K Landis Fancy Roller Scroller fancy-roller-scroller allows Stored XSS.This issue affects Fancy Roller Scroller: from n/a through <= 1.4.0.
- Product
- Fancy Roller Scroller
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Fancy Roller Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024DX Dark Site: Cross-Site Request Forgery (CSRF)CVE-2024-54337 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DevriX DX Dark Site devrix-dark-site allows Stored XSS.This issue affects DX Dark Site: from n/a through <= 1.0.1.
- Product
- DX Dark Site
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update DX Dark Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Hurrakify: Server-Side Request Forgery (SSRF)CVE-2024-54330 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through <= 2.4.
- Product
- Hurrakify
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Hurrakify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Hive Support: Cross-Site Request Forgery (CSRF)CVE-2024-54321 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hive Support Hive Support hive-support allows Cross Site Request Forgery.This issue affects Hive Support: from n/a through <= 1.1.2.
- Product
- Hive Support
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024AIcomments: Cross-Site Request Forgery (CSRF)CVE-2024-54307 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through <= 1.4.1.
- Product
- AIcomments
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update AIcomments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: Cross-Site Request Forgery (CSRF)CVE-2024-54306 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator allows Cross Site Request Forgery.This issue affects AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: from n/a through <= 1.6.2.
- Product
- AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024AutoWP: Cross-Site Request Forgery (CSRF)CVE-2024-54300 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Cross Site Request Forgery.This issue affects AutoWP: from n/a through <= 2.0.8.
- Product
- AutoWP
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update AutoWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024eewee admin custom: Cross-Site Request Forgery (CSRF)CVE-2024-54248 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.
- Product
- eewee admin custom
- Affected
- up to 1.8.2.4
- What to do
- Affects up to 1.8.2.4. Update eewee admin custom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Woocommerce Support System: Cross-Site Request Forgery (CSRF)CVE-2023-41686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2.
- Product
- Woocommerce Support System
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Woocommerce Support System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Themify Store Locator: Cross-Site Request ForgeryCVE-2024-12414 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the setting_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Themify Store Locator
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Themify Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024Hello In All Languages: Cross-Site Request ForgeryCVE-2024-12572 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Hello In All Languages
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello In All Languages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Cross-Site Request ForgeryCVE-2024-12526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfre_user_action' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Arena.IM – Live Blogging for real-time events
- Affected
- up to 0.4.1
- What to do
- Affects up to 0.4.1. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024HQ Rental Software: Cross-Site Request ForgeryCVE-2024-11689 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or incorrect nonce validation on the displaySettingsPage() function. This makes it possible for unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- HQ Rental Software
- Affected
- up to 1.5.29
- What to do
- Affects up to 1.5.29. Update HQ Rental Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2024Password for WP: Cross-Site Request ForgeryCVE-2024-11419 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the get3_init_admin_page() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Password for WP
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Password for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024dejure.org Vernetzungsfunktion: Cross-Site Request ForgeryCVE-2024-11417 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The dejure.org Vernetzungsfunktion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.97.5. This is due to missing or incorrect nonce validation on the djo_einstellungen_menue() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- dejure.org Vernetzungsfunktion
- Affected
- up to 1.97.5
- What to do
- Affects up to 1.97.5. Update dejure.org Vernetzungsfunktion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024WPC Order Notes for WooCommerce: Cross-Site Request ForgeryCVE-2024-12004 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajax_update_order_note() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WPC Order Notes for WooCommerce
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update WPC Order Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024Country Blocker: Cross-Site Request Forgery (CSRF)CVE-2024-54226 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in karlkiesinger Country Blocker country-blocker allows Stored XSS.This issue affects Country Blocker: from n/a through <= 3.2.
- Product
- Country Blocker
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024TH Variation Swatches: Cross-Site Request Forgery (CSRF)CVE-2023-28688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
- Product
- TH Variation Swatches
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update TH Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Tickera: Cross-Site Request Forgery (CSRF)CVE-2023-23726 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0.
- Product
- Tickera
- Affected
- up to 3.5.1.0
- What to do
- Affects up to 3.5.1.0. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Cross-Site Request ForgeryCVE-2024-12115 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.4. This is due to missing or incorrect nonce validation on the duplicate_poll() function. This makes it possible for unauthenticated attackers to duplicate polls via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Poll Maker – Versus Polls, Anonymous Polls, Image Polls
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024Paloma Widget: Cross-Site Request Forgery (CSRF)CVE-2024-54205 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Paloma Paloma Widget postman-widget allows Cross Site Request Forgery.This issue affects Paloma Widget: from n/a through <= 1.14.
- Product
- Paloma Widget
- Affected
- up to 1.14
- What to do
- Affects up to 1.14. Update Paloma Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Namaste! LMS: Cross-Site Request Forgery (CSRF)CVE-2024-53809 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a through <= 2.6.4.1.
- Product
- Namaste! LMS
- Affected
- up to 2.6.4.1
- What to do
- Affects up to 2.6.4.1. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP System: Cross-Site Request ForgeryCVE-2024-12003 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generate_wp_system_page_content() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP System
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WP System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024CLUEVO LMS, E-Learning Platform: Cross-Site Request ForgeryCVE-2024-11444 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due to missing or incorrect nonce validation on the cluevo_render_module_ui() function. This makes it possible for unauthenticated attackers to delete modules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- CLUEVO LMS, E-Learning Platform
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update CLUEVO LMS, E-Learning Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024Clickbank WordPress Plugin (Storefront): Cross-Site Request ForgeryCVE-2024-11336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Clickbank WordPress Plugin (Storefront) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the cs_menu page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Clickbank WordPress Plugin (Storefront)
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Clickbank WordPress Plugin (Storefront) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 5, 2024Simple Redirection: Cross-Site Request ForgeryCVE-2024-11341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Simple Redirection
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024Pulsating Chat Button: Cross-Site Request ForgeryCVE-2024-11813 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pulsating Chat Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.1. This is due to missing or incorrect nonce validation on the amin_chat_button_settings_page() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Pulsating Chat Button
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Pulsating Chat Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2024eDoc Easy Tables: Cross-Site Request Forgery (CSRF)CVE-2024-53793 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows Blind SQL Injection.This issue affects eDoc Easy Tables: from n/a through <= 1.29.
- Product
- eDoc Easy Tables
- Affected
- up to 1.29
- What to do
- Affects up to 1.29. Update eDoc Easy Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Advanced What should we write next about: Cross-Site Request Forgery (CSRF)CVE-2024-53789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows Stored XSS.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
- Product
- Advanced What should we write next about
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Photo Video Store: Cross-Site Request Forgery (CSRF)CVE-2024-53782 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in cmsaccount Photo Video Store photo-video-store allows Cross-Site Scripting (XSS).This issue affects Photo Video Store: from n/a through <= 21.07.
- Product
- Photo Video Store
- Affected
- up to 21.07
- What to do
- Affects up to 21.07. Update Photo Video Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024SpatialMatch IDX: Cross-Site Request Forgery (CSRF)CVE-2024-53781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Stored XSS.This issue affects SpatialMatch IDX: from n/a through <= 3.0.9.
- Product
- SpatialMatch IDX
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update SpatialMatch IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Load More Posts: Cross-Site Request Forgery (CSRF)CVE-2024-53780 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rajeevglocify Load More Posts load-more-posts allows Stored XSS.This issue affects Load More Posts: from n/a through <= 1.5.0.
- Product
- Load More Posts
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Load More Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Yahoo! WebPlayer: Cross-Site Request Forgery (CSRF)CVE-2024-53779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Stored XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.
- Product
- Yahoo! WebPlayer
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Yahoo! WebPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Simple Header and Footer: Cross-Site Request Forgery (CSRF)CVE-2024-53777 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alberto Reineri Simple Header and Footer simple-header-and-footer allows Stored XSS.This issue affects Simple Header and Footer: from n/a through <= 1.0.0.
- Product
- Simple Header and Footer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Simple Header and Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Donate Me: Cross-Site Request Forgery (CSRF)CVE-2024-53776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in raphaelheide Donate Me donate-me allows Stored XSS.This issue affects Donate Me: from n/a through <= 1.2.5.
- Product
- Donate Me
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Donate Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024DancePress (TRWA): Cross-Site Request Forgery (CSRF)CVE-2024-53775 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in benmoreassynt DancePress (TRWA) dancepress-trwa allows Cross Site Request Forgery.This issue affects DancePress (TRWA): from n/a through <= 3.1.11.
- Product
- DancePress (TRWA)
- Affected
- up to 3.1.11
- What to do
- Affects up to 3.1.11. Update DancePress (TRWA) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024RingCentral Communications: Cross-Site Request Forgery (CSRF)CVE-2024-53770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in pbmacintyre RingCentral Communications rccp-free allows Stored XSS.This issue affects RingCentral Communications: from n/a through <= 1.7.0.
- Product
- RingCentral Communications
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update RingCentral Communications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Custom Post Type to Map Store: Cross-Site Request Forgery (CSRF)CVE-2024-53769 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in lriaudel Custom Post Type to Map Store cpt-to-map-store allows Stored XSS.This issue affects Custom Post Type to Map Store: from n/a through <= 1.1.0.
- Product
- Custom Post Type to Map Store
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Custom Post Type to Map Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Mins To Read: Cross-Site Request Forgery (CSRF)CVE-2024-53765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Think201 Mins To Read mins-to-read allows Stored XSS.This issue affects Mins To Read: from n/a through <= 1.2.2.
- Product
- Mins To Read
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Mins To Read to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024FastBook: Cross-Site Request Forgery (CSRF)CVE-2024-53762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This issue affects FastBook: from n/a through <= 1.1.
- Product
- FastBook
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update FastBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024WP Revisions Manager: Cross-Site Request Forgery (CSRF)CVE-2024-53761 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in P Roy WP Revisions Manager wp-revisions-manager allows Cross Site Request Forgery.This issue affects WP Revisions Manager: from n/a through <= 1.0.2.
- Product
- WP Revisions Manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Revisions Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Third Party Cookie Eraser: Cross-Site Request Forgery (CSRF)CVE-2024-53755 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Pernici Third Party Cookie Eraser third-party-cookie-eraser allows Stored XSS.This issue affects Third Party Cookie Eraser: from n/a through <= 1.0.2.
- Product
- Third Party Cookie Eraser
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Third Party Cookie Eraser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Out Of Stock Badge: Cross-Site Request Forgery (CSRF)CVE-2024-53754 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Irish_Cathal Out Of Stock Badge out-of-stock-badge allows Cross Site Request Forgery.This issue affects Out Of Stock Badge: from n/a through <= 2.0.
- Product
- Out Of Stock Badge
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Out Of Stock Badge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024CultBooking Hotel Booking Engine: Cross-Site Request Forgery (CSRF)CVE-2024-53753 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CultBooking CultBooking Hotel Booking Engine cultbooking-booking-engine allows Stored XSS.This issue affects CultBooking Hotel Booking Engine: from n/a through <= 2.1.
- Product
- CultBooking Hotel Booking Engine
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update CultBooking Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Build App Online: Cross-Site Request Forgery (CSRF)CVE-2024-53751 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.
- Product
- Build App Online
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.