Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 55 of 86
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56271 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
- Product
- WP SecureSubmit
- Affected
- up to 1.5.20
- What to do
- Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025CubeWP Forms: Missing AuthorizationCVE-2024-51651 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.10.
- Product
- CubeWP Forms
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WordPress Auction: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8855 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
- Product
- WordPress Auction
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.44
- What to do
- Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-23672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
- Product
- GiveWP
- Affected
- up to 2.25.1
- What to do
- Affects up to 2.25.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Table Manager: Missing AuthorizationCVE-2022-47601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.
- Product
- WP Table Manager
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update WP Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Post Teaser: Missing AuthorizationCVE-2022-45811 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WeyHan Ng Post Teaser.This issue affects Post Teaser: from n/a through 4.1.5.
- Product
- Post Teaser
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update Post Teaser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025JetEngine: Missing AuthorizationCVE-2023-48758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.
- Product
- JetEngine
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Porto Theme - Functionality: Missing AuthorizationCVE-2023-48739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Porto Theme Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 2.12.1.
- Product
- Porto Theme - Functionality
- What to do
- Update Porto Theme - Functionality to the newest version.
Jan 2, 202510WebAnalytics: Missing AuthorizationCVE-2023-47807 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through <= 1.2.12.
- Product
- 10WebAnalytics
- Affected
- up to 1.2.12
- What to do
- Affects up to 1.2.12. Update 10WebAnalytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025LuckyWP Scripts Control: Missing AuthorizationCVE-2023-47778 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control luckywp-scripts-control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through <= 1.2.1.
- Product
- LuckyWP Scripts Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update LuckyWP Scripts Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025IMPress Listings: Missing AuthorizationCVE-2023-45633 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in IDX IMPress Listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IMPress Listings: from n/a through 2.6.2.
- Product
- IMPress Listings
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update IMPress Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 202510Web Map Builder for Google Maps: Missing AuthorizationCVE-2023-45272 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73.
- Product
- 10Web Map Builder for Google Maps
- Affected
- up to 1.0.73
- What to do
- Affects up to 1.0.73. Update 10Web Map Builder for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Putler Connector for WooCommerce: Missing AuthorizationCVE-2023-40327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Putler / Storeapps Putler Connector for WooCommerce.This issue affects Putler Connector for WooCommerce: from n/a through 2.12.0.
- Product
- Putler Connector for WooCommerce
- Affected
- up to 2.12.0
- What to do
- Affects up to 2.12.0. Update Putler Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025ARMember Premium: Missing AuthorizationCVE-2023-39994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2.
- Product
- ARMember Premium
- Affected
- up to 5.9.2
- What to do
- Affects up to 5.9.2. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WoodMart: Missing AuthorizationCVE-2023-32240 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Xtemos WoodMart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoodMart: from n/a through 7.2.1.
- Product
- WoodMart
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Analytify: Missing AuthorizationCVE-2022-45830 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Analytify.This issue affects Analytify: from n/a through 4.2.3.
- Product
- Analytify
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Subscribe to Category: Missing AuthorizationCVE-2022-43476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Category: from n/a through 2.7.4.
- Product
- Subscribe to Category
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update Subscribe to Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Gallery Images Ape: Missing AuthorizationCVE-2022-41995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Galleryape Gallery Images Ape allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gallery Images Ape: from n/a through 2.2.8.
- Product
- Gallery Images Ape
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-56266 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.8.
- Product
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025AyeCode Connect: Missing AuthorizationCVE-2024-56255 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stiofan AyeCode Connect ayecode-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AyeCode Connect: from n/a through <= 1.3.8.
- Product
- AyeCode Connect
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update AyeCode Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-56253 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in supsystic Data Tables Generator by Supsystic data-tables-generator-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Data Tables Generator by Supsystic: from n/a through <= 1.10.36.
- Product
- Data Tables Generator by Supsystic
- Affected
- up to 1.10.36
- What to do
- Affects up to 1.10.36. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Ashe Extra: Missing AuthorizationCVE-2024-56244 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Royal Ashe Extra ashe-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe Extra: from n/a through <= 1.2.92.
- Product
- Ashe Extra
- Affected
- up to 1.2.92
- What to do
- Affects up to 1.2.92. Update Ashe Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WPSSO Core: Missing AuthorizationCVE-2024-56243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through <= 18.18.1.
- Product
- WPSSO Core
- Affected
- up to 18.18.1
- What to do
- Affects up to 18.18.1. Update WPSSO Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Floating Action Buttons: Missing AuthorizationCVE-2024-56238 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud Floating Action Buttons floating-action-buttons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Floating Action Buttons: from n/a through <= 0.9.1.
- Product
- Floating Action Buttons
- Affected
- up to 0.9.1
- What to do
- Affects up to 0.9.1. Update Floating Action Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Hestia Nginx Cache: Missing AuthorizationCVE-2024-56236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Juni Hestia Nginx Cache hestia-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hestia Nginx Cache: from n/a through <= 2.4.0.
- Product
- Hestia Nginx Cache
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Hestia Nginx Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Ultimate Addons for Contact Form 7: Missing AuthorizationCVE-2023-47693 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.2.6.
- Product
- Ultimate Addons for Contact Form 7
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Flo Forms: Missing AuthorizationCVE-2023-47692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.41.
- Product
- Flo Forms
- Affected
- up to 1.0.41
- What to do
- Affects up to 1.0.41. Update Flo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Animator: Missing AuthorizationCVE-2023-47689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10.
- Product
- Animator
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update Animator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Dragfy Addons for Elementor: Missing AuthorizationCVE-2023-47661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dragfy Dragfy Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dragfy Addons for Elementor: from n/a through 1.0.2.
- Product
- Dragfy Addons for Elementor
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Dragfy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025EazyDocs: Missing AuthorizationCVE-2023-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through <= 2.3.5.
- Product
- EazyDocs
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025BadgeOS: Missing AuthorizationCVE-2023-47647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LearningTimes BadgeOS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BadgeOS: from n/a through 3.7.1.6.
- Product
- BadgeOS
- Affected
- up to 3.7.1.6
- What to do
- Affects up to 3.7.1.6. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Visitors Traffic Real Time Statistics: Missing AuthorizationCVE-2023-47557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/a through <= 7.2.
- Product
- Visitors Traffic Real Time Statistics
- Affected
- up to 7.2
- What to do
- Affects up to 7.2. Update Visitors Traffic Real Time Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Auto Tag Creator: Missing AuthorizationCVE-2023-47523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecreate Infotech Auto Tag Creator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Tag Creator: from n/a through 1.0.2.
- Product
- Auto Tag Creator
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Auto Tag Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Seers: Missing AuthorizationCVE-2023-47515 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Seers Seers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seers: from n/a through 8.1.1.
- Product
- Seers
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update Seers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025CoCart – Headless ecommerce: Missing AuthorizationCVE-2023-47241 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2.
- Product
- CoCart – Headless ecommerce
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update CoCart – Headless ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Short URL: Missing AuthorizationCVE-2023-47225 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through <= 1.6.8.
- Product
- Short URL
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Travel: Missing AuthorizationCVE-2023-47224 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 7.8.0.
- Product
- WP Travel
- Affected
- up to 7.8.0
- What to do
- Affects up to 7.8.0. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Simple Job Board: Missing AuthorizationCVE-2023-47188 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5.
- Product
- Simple Job Board
- Affected
- up to 2.10.5
- What to do
- Affects up to 2.10.5. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Animated Rotating Words: Missing AuthorizationCVE-2023-47187 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Rotating Words: from n/a through <= 5.4.
- Product
- Animated Rotating Words
- Affected
- up to 5.4
- What to do
- Affects up to 5.4. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-47183 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1.
- Product
- GiveWP
- Affected
- up to 2.33.1
- What to do
- Affects up to 2.33.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Finale Lite: Missing AuthorizationCVE-2023-47180 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Finale Lite: from n/a through 2.16.0.
- Product
- Finale Lite
- Affected
- up to 2.16.0
- What to do
- Affects up to 2.16.0. Update Finale Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WooODT Lite: Missing AuthorizationCVE-2023-47179 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through <= 2.4.6.
- Product
- WooODT Lite
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update WooODT Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WordPress CTA: Missing AuthorizationCVE-2023-46644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8.
- Product
- WordPress CTA
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update WordPress CTA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025kk Star Ratings: Missing AuthorizationCVE-2023-46639 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.5.
- Product
- kk Star Ratings
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update kk Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Generate Dummy Posts: Missing AuthorizationCVE-2023-46637 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saurav Sharma Generate Dummy Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Generate Dummy Posts: from n/a through 1.0.0.
- Product
- Generate Dummy Posts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Generate Dummy Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025YITH WooCommerce Product Add-Ons: Missing AuthorizationCVE-2023-46635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.2.0.
- Product
- YITH WooCommerce Product Add-Ons
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Glossary: Missing AuthorizationCVE-2023-46633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in TCBarrett Glossary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Glossary: from n/a through 3.1.2.
- Product
- Glossary
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025My Shortcodes: Missing AuthorizationCVE-2023-46632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in David Cramer My Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Shortcodes: from n/a through 2.3.
- Product
- My Shortcodes
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update My Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Product Recommendation Quiz for eCommerce: Missing AuthorizationCVE-2023-46631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RevenueHunt Product Recommendation Quiz for eCommerce product-recommendation-quiz-for-ecommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Recommendation Quiz for eCommerce: from n/a through <= 2.1.2.
- Product
- Product Recommendation Quiz for eCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Recommendation Quiz for eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.