Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 53 of 94
Oct 29, 2024DarkMySite – Advanced Dark Mode Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-50466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite – Advanced Dark Mode Plugin for WordPress: from n/a through 1.2.8.
- Product
- DarkMySite – Advanced Dark Mode Plugin for
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update DarkMySite – Advanced Dark Mode Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Google Docs RSVP: Cross-Site Request Forgery (CSRF)CVE-2024-49672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through <= 2.0.1.
- Product
- Google Docs RSVP
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Google Docs RSVP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024AMP for WP – Accelerated Mobile Pages: Cross-Site Request ForgeryCVE-2024-9598 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the logged in user's cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- AMP for WP – Accelerated Mobile Pages
- Affected
- up to 1.0.99.1
- What to do
- Affects up to 1.0.99.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2024MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution: Cross-Site Request ForgeryCVE-2024-9943 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several functions in api/class-mvx-rest-controller.php. This makes it possible for unauthenticated attackers to update vendor account details, create vendor accounts, and delete arbitrary users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 23, 2024Transients Manager: Cross-Site Request ForgeryCVE-2024-10045 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possible for unauthenticated attackers to delete transients via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Transients Manager
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Transients Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2024Category and Taxonomy Meta Fields: Cross-Site Request ForgeryCVE-2024-9588 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Category and Taxonomy Meta Fields
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 21, 2024LatePoint: Cross-Site Request Forgery (CSRF)CVE-2024-43945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.
- Product
- LatePoint
- Affected
- up to 4.9.91
- What to do
- Affects up to 4.9.91. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Most And Least Read Posts Widget: Cross-Site Request Forgery (CSRF)CVE-2024-49628 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Cross Site Request Forgery.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.18.
- Product
- Most And Least Read Posts Widget
- Affected
- up to 2.5.18
- What to do
- Affects up to 2.5.18. Update Most And Least Read Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WordPress Image SEO: Cross-Site Request Forgery (CSRF)CVE-2024-49627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from n/a through 1.1.4.
- Product
- WordPress Image SEO
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update WordPress Image SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WP Content Copy Protection & No Right Click: Cross-Site Request Forgery (CSRF)CVE-2024-49306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.
- Product
- WP Content Copy Protection & No Right Click
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update WP Content Copy Protection & No Right Click to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Cooked Pro: Cross-Site Request Forgery (CSRF)CVE-2024-49290 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.
- Product
- Cooked Pro
- Fixed in
- 1.8.0
- What to do
- Update Cooked Pro to 1.8.0 or newer.
Oct 20, 2024IdeaPush: Cross-Site Request Forgery (CSRF)CVE-2024-49275 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Site Request Forgery.This issue affects IdeaPush: from n/a through <= 8.69.
- Product
- IdeaPush
- Affected
- up to 8.69
- What to do
- Affects up to 8.69. Update IdeaPush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024VOD Infomaniak: Cross-Site Request Forgery (CSRF)CVE-2024-49274 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.
- Product
- VOD Infomaniak
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Social Auto Poster: Cross-Site Request Forgery (CSRF)CVE-2024-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through <= 5.3.15.
- Product
- Social Auto Poster
- Affected
- up to 5.3.15
- What to do
- Affects up to 5.3.15. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Table of Contents Plus: Cross-Site Request Forgery (CSRF)CVE-2024-49250 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through <= 2408.
- Product
- Table of Contents Plus
- Affected
- up to 2408
- What to do
- Affects up to 2408. Update Table of Contents Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024CartBounty – Save and recover abandoned carts for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-47634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through <= 8.2.
- Product
- CartBounty – Save and recover abandoned carts for WooCommerce
- Affected
- up to 8.2
- What to do
- Affects up to 8.2. Update CartBounty – Save and recover abandoned carts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Endless Posts Navigation: Cross-Site Request Forgery (CSRF)CVE-2024-49629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.
- Product
- Endless Posts Navigation
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Endless Posts Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Back Link Tracker: Cross-Site Request Forgery (CSRF)CVE-2024-49617 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.
- Product
- Back Link Tracker
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Back Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SafetyForms: Cross-Site Request Forgery (CSRF)CVE-2024-49615 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0.
- Product
- SafetyForms
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SafetyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024AVChat Video Chat: Cross-Site Request Forgery (CSRF)CVE-2024-49605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.
- Product
- AVChat Video Chat
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update AVChat Video Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024GoogleDrive folder list: Cross-Site Request Forgery (CSRF)CVE-2024-49335 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.
- Product
- GoogleDrive folder list
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update GoogleDrive folder list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Apa Banner Slider: Cross-Site Request Forgery (CSRF)CVE-2024-49622 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.
- Product
- Apa Banner Slider
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Apa Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024APA Register Newsletter Form: Cross-Site Request Forgery (CSRF)CVE-2024-49621 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.
- Product
- APA Register Newsletter Form
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update APA Register Newsletter Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2024EventON PRO - WordPress Virtual Event Calendar: Cross-Site Request ForgeryCVE-2023-6243 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admin_test_email function. This makes it possible for unauthenticated attackers to send test emails to arbitrary email addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- EventON PRO - WordPress Virtual Event Calendar
- Affected
- up to 4.6.8
- What to do
- Affects up to 4.6.8. Update EventON PRO - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.myeventon.complugins.trac.wordpress.org
Oct 18, 2024Infinite-Scroll: Cross-Site Request ForgeryCVE-2024-10040 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation on the process_ajax_edit and process_ajax_delete function. This makes it possible for unauthenticated attackers to make changes to plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Infinite-Scroll
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Infinite-Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2024VKontakte Wall Post: Cross-Site Request Forgery (CSRF)CVE-2024-49313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: from n/a through <= 2.0.
- Product
- VKontakte Wall Post
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update VKontakte Wall Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Edwiser Bridge: Server-Side Request Forgery (SSRF)CVE-2024-49312 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge.This issue affects Edwiser Bridge: from n/a through <= 3.0.7.
- Product
- Edwiser Bridge
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Pinpoint Booking System: Cross-Site Request Forgery (CSRF)CVE-2024-49304 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.5.7
- What to do
- Affects up to 2.9.9.5.7. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Ahmeti Wp Timeline: Cross-Site Request Forgery (CSRF)CVE-2024-49237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through <= 5.1.
- Product
- Ahmeti Wp Timeline
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update Ahmeti Wp Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024CJ Change Howdy: Cross-Site Request Forgery (CSRF)CVE-2024-49223 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change Howdy: from n/a through <= 3.3.1.
- Product
- CJ Change Howdy
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update CJ Change Howdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024cSlider: Cross-Site Request Forgery (CSRF)CVE-2024-49221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.
- Product
- cSlider
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update cSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Cookie Scanner: Cross-Site Request Forgery (CSRF)CVE-2024-49220 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: from n/a through <= 1.1.
- Product
- Cookie Scanner
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Cookie Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Wsify Widget: Cross-Site Request Forgery (CSRF)CVE-2024-48048 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.
- Product
- Wsify Widget
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wsify Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2024-48037 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.2.
- Product
- Contact Form Widget
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Featured Posts with Multiple Custom Groups (FPMCG): Cross-Site Request Forgery (CSRF)CVE-2024-48031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpmcg allows Cross Site Request Forgery.This issue affects Featured Posts with Multiple Custom Groups (FPMCG): from n/a through <= 4.0.
- Product
- Featured Posts with Multiple Custom Groups (FPMCG)
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update Featured Posts with Multiple Custom Groups (FPMCG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Linked Variation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-48047 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through <= 1.0.5.
- Product
- Linked Variation for WooCommerce
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Linked Variation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024wp-Monalisa: Cross-Site Request Forgery (CSRF)CVE-2024-48038 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4.
- Product
- wp-Monalisa
- Affected
- up to 6.4
- What to do
- Affects up to 6.4. Update wp-Monalisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.35.1
- What to do
- Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9351 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.35.1
- What to do
- Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2024File Manager Pro: Cross-Site Request ForgeryCVE-2024-8507 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- File Manager Pro
- Affected
- up to 8.3.9
- What to do
- Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfilemanagerpro.iowordfence.com
Oct 16, 2024The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to mCVE-2022-4974 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfreemius.comweb.archive.org
Oct 16, 2024WP Lead Plus X: Cross-Site Request ForgeryCVE-2020-36839 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as adding pages to the site and/or replacing site content with malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Lead Plus X
- Affected
- up to 0.99
- What to do
- Affects up to 0.99. Update WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 16, 2024The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively.CVE-2012-10018 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 15, 2024WP ULike – The Ultimate Engagement Toolkit for Websites: Cross-Site Request ForgeryCVE-2024-9649 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7.4. This is due to missing or incorrect nonce validation on the wp_ulike_delete_history_api() function. This makes it possible for unauthenticated attackers to delete engagements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP ULike – The Ultimate Engagement Toolkit for Websites
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update WP ULike – The Ultimate Engagement Toolkit for Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 12, 2024ImagePress – Image Gallery: Cross-Site Request ForgeryCVE-2024-9778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the 'imagepress_admin_page' function. This makes it possible for unauthenticated attackers to update plugin settings, including redirection URLs, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ImagePress – Image Gallery
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Easy PayPal Gift Certificate: Cross-Site Request ForgeryCVE-2024-9592 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgc_plugin_options' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Easy PayPal Gift Certificate
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy PayPal Gift Certificate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 9, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue): Cross-Site Request ForgeryCVE-2024-8477 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.87. This is due to missing or incorrect nonce validation on the Init() function. This makes it possible for unauthenticated attackers to log out of a Brevo connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)
- Affected
- up to 3.1.87
- What to do
- Affects up to 3.1.87. Update Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 6, 2024NiceJob: Cross-Site Request Forgery (CSRF)CVE-2024-44028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.
- Product
- NiceJob
- What to do
- Update NiceJob to the newest version.
Oct 5, 2024TinyPNG: Cross-Site Request Forgery (CSRF)CVE-2024-47635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TinyPNG TinyPNG tiny-compress-images allows Cross Site Request Forgery.This issue affects TinyPNG: from n/a through <= 3.4.3.
- Product
- TinyPNG
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update TinyPNG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Cross-Site Request ForgeryCVE-2024-8520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.