Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,221 results · page 50 of 85

Jun 21, 2024Book Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37230 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Book Landing Page.This issue affects Book Landing Page: from n/a through 1.2.3.
Product
Book Landing Page
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Newsletters: Cross Site Request Forgery (CSRF)CVE-2024-37227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7.
Product
Newsletters
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Ali2Woo Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37212 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
Product
Ali2Woo Lite
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update Ali2Woo Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Digital Newspaper: Cross-Site Request Forgery (CSRF)CVE-2024-37198 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.5.
Product
Digital Newspaper
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Digital Newspaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Uncanny Automator Pro: Cross Site Request Forgery (CSRF)CVE-2024-37118 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.This issue affects Uncanny Automator Pro: from n/a through 5.3.
Product
Uncanny Automator Pro
Affected
up to 5.3
What to do
Affects up to 5.3. Update Uncanny Automator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Hueman: Cross-Site Request Forgery (CSRF)CVE-2024-35772 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24.
Product
Hueman
Affected
up to 3.7.24
What to do
Affects up to 3.7.24. Update Hueman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Customizr: Cross-Site Request Forgery (CSRF)CVE-2024-35771 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Customizr.This issue affects Customizr: from n/a through 4.4.21.
Product
Customizr
Affected
up to 4.4.21
What to do
Affects up to 4.4.21. Update Customizr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Vimeography: Vimeo Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2024-35770 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gallery WordPress Plugin: from n/a through 2.4.1.
Product
Vimeography: Vimeo Video Gallery
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Vimeography: Vimeo Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024GamiPress: Cross-Site Request Forgery (CSRF)CVE-2023-25697 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6.
Product
GamiPress
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Master Slider: Cross-Site Request Forgery (CSRF)CVE-2023-50900 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10.
Product
Master Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-1407 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
Product
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected
up to 2.12.10
What to do
Affects up to 2.12.10. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Cross-Site Request ForgeryCVE-2024-5343 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.19. This is due to missing or incorrect nonce validation on the 'rbs_ajax_create_article' and 'rbs_ajax_reset_views' functions. This makes it possible for unauthenticated attackers to create new posts and reset gallery view counts via a forged request granted they can trick a Contributor+ level user into performing an action such as clicking on a link.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024WordPress Picture / Portfolio / Media Gallery: Server-Side Request ForgeryCVE-2024-5021 · WordPress plugins & themes · reported by WordfenceCritical 9.3
The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
WordPress Picture / Portfolio / Media Gallery
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WordPress Picture / Portfolio / Media Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Custom Product List Table: Cross-Site Request ForgeryCVE-2024-4541 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Product List Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation when modifying products. This makes it possible for unauthenticated attackers to add, delete, bulk edit, approve or cancel products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom Product List Table
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Custom Product List Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 14, 2024WP STAGING Pro WordPress Backup: Cross-Site Request ForgeryCVE-2024-5551 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the 'sub' parameter called from the WP STAGING WordPress Backup Plugin - Backup Duplicator & Migration plugin. This makes it possible for unauthenticated attackers to include any local files that end in '-settings.php' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP STAGING Pro WordPress Backup
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update WP STAGING Pro WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wp-staging.com
Jun 14, 2024ElementsKit PRO: Server-Side Request ForgeryCVE-2024-4404 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
ElementsKit PRO
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update ElementsKit PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmet.com wordfence.com
Jun 14, 2024Schema App Structured Data: Cross-Site Request ForgeryCVE-2024-0892 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the MarkUpdate function. This makes it possible for unauthenticated attackers to update and delete post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Schema App Structured Data
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024Simple Sitemap – Create a Responsive HTML Sitemap: Cross-Site Request ForgeryCVE-2023-6492 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Simple Sitemap – Create a Responsive HTML Sitemap
Affected
up to 3.5.13
What to do
Affects up to 3.5.13. Update Simple Sitemap – Create a Responsive HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024Grab & Save: Cross-Site Request Forgery (CSRF)CVE-2023-47845 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lim Kai Yang Grab & Save.This issue affects Grab & Save: from n/a through 1.0.4.
Product
Grab & Save
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Grab & Save to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Bricksforge: Missing AuthorizationCVE-2024-31244 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
Product
Bricksforge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Bricksforge: Missing AuthorizationCVE-2024-31243 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
Product
Bricksforge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024WP-Recall: Cross-Site Request Forgery (CSRF)CVE-2024-35657 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6.
Product
WP-Recall
Affected
up to 16.26.6
What to do
Affects up to 16.26.6. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Analytify: Cross-Site Request Forgery (CSRF)CVE-2024-35689 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3.
Product
Analytify
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024ElasticPress: Cross-Site Request Forgery (CSRF)CVE-2024-35684 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1.
Product
ElasticPress
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update ElasticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024TablePress – Tables in WordPress made easy: Server-Side Request ForgeryCVE-2024-4354 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via the get_files_to_import() function. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Due to the complex nature of protecting against DNS rebind attacks in WordPress software, we settled on the developer simply restricting the usage of the URL import functionality to just administrators. While this is not optimal, we feel this poses a minimal risk to most site owners and ideally WordPress core would correct this issue in wp_safe_remote_get() and other functions.
Product
TablePress – Tables in WordPress made easy
Affected
up to 2.3
What to do
Affects up to 2.3. Update TablePress – Tables in WordPress made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024The Moneytizer: Cross-Site Request ForgeryCVE-2023-6968 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
The Moneytizer
Affected
up to 9.6.3
What to do
Affects up to 9.6.3. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 5, 2024Pure Chat: Cross-Site Request Forgery (CSRF)CVE-2024-35673 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22.
Product
Pure Chat
Affected
up to 2.22
What to do
Affects up to 2.22. Update Pure Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024Mollie Forms: Cross-Site Request ForgeryCVE-2024-2368 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible for unauthenticated attackers to duplicate forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mollie Forms
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update Mollie Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 3, 2024Integration for Contact Form 7 and Constant Contact: Cross-Site Request Forgery (CSRF)CVE-2024-35632 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.
Product
Integration for Contact Form 7 and Constant Contact
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Integration for Contact Form 7 and Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Ninja Tables: Server-Side Request Forgery (SSRF)CVE-2024-35635 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.
Product
Ninja Tables
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Blocksy Companion: Server-Side Request Forgery (SSRF)CVE-2024-35633 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.
Product
Blocksy Companion
Affected
up to 2.0.42
What to do
Affects up to 2.0.42. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024ActiveDEMAND: Cross-Site Request Forgery (CSRF)CVE-2024-35638 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43.
Product
ActiveDEMAND
Affected
up to 0.2.43
What to do
Affects up to 0.2.43. Update ActiveDEMAND to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Church Admin: Server-Side Request Forgery (SSRF)CVE-2024-35637 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.
Product
Church Admin
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 2, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Cross-Site Request ForgeryCVE-2024-4344 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.1.13. This is due to missing or incorrect nonce validation on the exec function. This makes it possible for unauthenticated attackers to disable pin protection for the admin interface of the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Shield Security – Smart Bot Blocking & Intrusion Prevention Security
Affected
up to 19.1.13
What to do
Affects up to 19.1.13. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2024Uploadcare File Uploader and Adaptive Delivery (beta): Cross-Site Request Forgery (CSRF)CVE-2024-35636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery (beta): from n/a through 3.0.11.
Product
Uploadcare File Uploader and Adaptive Delivery (beta)
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Uploadcare File Uploader and Adaptive Delivery (beta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 31, 2024Auto Featured Image (Auto Post Thumbnail): Server-Side Request ForgeryCVE-2023-7073 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 30, 2024Comparison Slider: Cross-Site Request ForgeryCVE-2024-4426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on several functions hooked to AJAX actions. This makes it possible for unauthenticated attackers to change slider titles, delete sliders and modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Comparison Slider
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Comparison Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 30, 2024AffiEasy: Cross-Site Request ForgeryCVE-2024-4218 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to plugin improperly releasing the tagged and patched version of the plugin - the vulnerable version is used as the core files, while the patched version was included in a 'trunk' folder. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
AffiEasy
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update AffiEasy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024WP To Do: Cross-Site Request ForgeryCVE-2024-3947 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_settings() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP To Do
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP To Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024WP To Do: Cross-Site Request ForgeryCVE-2024-3945 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_manage() function. This makes it possible for unauthenticated attackers to add new todo items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP To Do
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP To Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024WP To Do: Cross-Site Request ForgeryCVE-2024-3943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_addcomment function. This makes it possible for unauthenticated attackers to add comments to to do items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP To Do
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP To Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2024WP-ViperGB: Cross-Site Request ForgeryCVE-2024-4409 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP-ViperGB
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update WP-ViperGB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 22, 2024WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation: Server-Side Request ForgeryCVE-2024-1855 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpc_check_for_submission function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application.
Product
WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation
Affected
up to 2.2.23
What to do
Affects up to 2.2.23. Update WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024Memberpress: Blind Server-Side Request ForgeryCVE-2024-5031 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Memberpress
Affected
up to 1.11.29
What to do
Affects up to 1.11.29. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberpress.com wordfence.com
May 22, 2024NextScripts: Social Networks Auto-Poster: Cross-Site Request ForgeryCVE-2024-1446 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This is due to missing or incorrect nonce validation on the nxssnap-reposter page. This makes it possible for unauthenticated attackers to delete arbitrary posts or pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
NextScripts: Social Networks Auto-Poster
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024EmpowerWP: Cross-Site Request Forgery (CSRF)CVE-2024-34809 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.
Product
EmpowerWP
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update EmpowerWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Fast Custom Social Share by CodeBard: Cross-Site Request Forgery (CSRF)CVE-2024-34807 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CodeBard Fast Custom Social Share by CodeBard fast-custom-social-share-by-codebard.This issue affects Fast Custom Social Share by CodeBard: from n/a through <= 1.1.2.
Product
Fast Custom Social Share by CodeBard
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Fast Custom Social Share by CodeBard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Clearfy Cache: Cross-Site Request Forgery (CSRF)CVE-2024-34806 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creative Motion Clearfy Cache.This issue affects Clearfy Cache: from n/a through 2.2.1.
Product
Clearfy Cache
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Clearfy Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Integration for Contact Form 7 HubSpot: Cross-Site Request Forgery (CSRF)CVE-2024-34756 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 HubSpot.This issue affects Integration for Contact Form 7 HubSpot: from n/a through 1.3.1.
Product
Integration for Contact Form 7 HubSpot
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Integration for Contact Form 7 HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Integration for Contact Form 7 and Salesforce: Cross-Site Request Forgery (CSRF)CVE-2024-34755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9.
Product
Integration for Contact Form 7 and Salesforce
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Integration for Contact Form 7 and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.