Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,221 results · page 56 of 85

Mar 28, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-29090 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.
Product
AI Engine: ChatGPT Chatbot
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update AI Engine: ChatGPT Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com vicarius.io
Mar 28, 2024Gutenberg Blocks by Kadence Blocks: Server-Side Request Forgery (SSRF)CVE-2024-23500 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.2.19.
Product
Gutenberg Blocks by Kadence Blocks
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Avada: Server-Side Request Forgery (SSRF)CVE-2023-39313 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
Product
Avada
Affected
up to 7.11.1
What to do
Affects up to 7.11.1. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Spectra: Server-Side Request Forgery (SSRF)CVE-2023-36679 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
Product
Spectra
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Server-Side Request Forgery (SSRF)CVE-2023-34370 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Premium Starter Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4; Premium Starter Templates: from n/a through 3.2.4.
Product
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Events Manager – Calendar, Bookings, Tickets, and more!: Cross-Site Request ForgeryCVE-2024-2110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 6.4.7.1
What to do
Affects up to 6.4.7.1. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024BizPrint: Cross-Site Request Forgery (CSRF)CVE-2024-29773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint allows Cross-Site Scripting (XSS).This issue affects BizPrint: from n/a through 4.5.5.
Product
BizPrint
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Post Video Players: Cross-Site Request Forgery (CSRF)CVE-2024-23515 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159.
Product
Post Video Players
Affected
up to 1.159
What to do
Affects up to 1.159. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Don't Muck My Markup: Cross-Site Request Forgery (CSRF)CVE-2024-23510 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8.
Product
Don't Muck My Markup
Affected
up to 1.8
What to do
Affects up to 1.8. Update Don't Muck My Markup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WooCommerce Stripe Payment Gateway: Cross-Site Request Forgery (CSRF)CVE-2023-44999 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.0.
Product
WooCommerce Stripe Payment Gateway
Affected
up to 7.6.0
What to do
Affects up to 7.6.0. Update WooCommerce Stripe Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Fusion Builder: Cross-Site Request Forgery (CSRF)CVE-2023-39311 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
Product
Fusion Builder
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WordPress Countdown Widget: Cross-Site Request Forgery (CSRF)CVE-2022-45847 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countdown Widget: from n/a through 3.1.9.1.
Product
WordPress Countdown Widget
Affected
up to 3.1.9.1
What to do
Affects up to 3.1.9.1. Update WordPress Countdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024RegistrationMagic: Cross-Site Request Forgery (CSRF)CVE-2024-2951 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0.
Product
RegistrationMagic
Affected
up to 5.3.0.0
What to do
Affects up to 5.3.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Calliope: Cross-Site Request Forgery (CSRF)CVE-2024-2904 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33.
Product
Calliope
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Calliope to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Clotya: Cross-Site Request Forgery (CSRF)CVE-2023-49838 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in KlbTheme Clotya theme, KlbTheme Cosmetsy theme, KlbTheme Furnob theme, KlbTheme Bacola theme, KlbTheme Partdo theme, KlbTheme Medibazar theme, KlbTheme Machic theme.This issue affects Clotya theme: from n/a through 1.1.6; Cosmetsy theme: from n/a through 1.7.7; Furnob theme: from n/a through 1.2.2; Bacola theme: from n/a through 1.3.3; Partdo theme: from n/a through 1.1.1; Medibazar theme: from n/a through 1.8.6; Machic theme: from n/a through 1.2.8.
Product
Clotya
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Clotya to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024EnvíaloSimple: Cross-Site Request Forgery (CSRF)CVE-2023-51416 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in EnvialoSimple EnvíaloSimple.This issue affects EnvíaloSimple: from n/a through 2.2.
Product
EnvíaloSimple
Affected
up to 2.2
What to do
Affects up to 2.2. Update EnvíaloSimple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024easy-popup-show all versions: Cross-site request forgery (CSRF)CVE-2024-29009 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the administrator and to perform unintended operations if the administrator views a malicious page while logged in.
Product
easy-popup-show all versions
What to do
Update easy-popup-show all versions to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 23, 2024Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing: Cross-Site Request ForgeryCVE-2024-2326 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's configuration including stripe integration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2024Super Page Cache for Cloudflare: Cross-Site Request Forgery (CSRF)CVE-2024-27968 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflare: from n/a through 4.7.5.
Product
Super Page Cache for Cloudflare
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update Super Page Cache for Cloudflare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024File Manager: Cross-Site Request ForgeryCVE-2024-1538 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
Product
File Manager
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Tutor LMS – eLearning and online course solution: Cross-Site Request ForgeryCVE-2024-1503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Cross-Site Request ForgeryCVE-2024-1214 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the save_groups_list function. This makes it possible for unauthenticated attackers to disconnect a site's facebook or instagram page/group connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Cross-Site Request ForgeryCVE-2024-1213 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This makes it possible for unauthenticated attackers to connect their facebook and instagram pages to the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Live Sales Notification for Woocommerce – Woomotiv: Cross-Site Request ForgeryCVE-2024-1325 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the 'ajax_cancel_review' function. This makes it possible for unauthenticated attackers to reset the site's review count via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Live Sales Notification for Woocommerce – Woomotiv
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Live Sales Notification for Woocommerce – Woomotiv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024Contests by Rewards Fuel: Cross-Site Request ForgeryCVE-2024-1785 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site's user with the edit_posts capability into performing an action such as clicking on a link.
Product
Contests by Rewards Fuel
Affected
up to 2.0.62
What to do
Affects up to 2.0.62. Update Contests by Rewards Fuel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024Builder for WooCommerce reviews shortcodes – ReviewShort: Cross-Site Request Forgery (CSRF)CVE-2024-29093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.3.
Product
Builder for WooCommerce reviews shortcodes – ReviewShort
Affected
up to 1.01.3
What to do
Affects up to 1.01.3. Update Builder for WooCommerce reviews shortcodes – ReviewShort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024BeePress: Cross-Site Request Forgery (CSRF)CVE-2024-27197 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Bee BeePress allows Stored XSS.This issue affects BeePress: from n/a through 6.9.8.
Product
BeePress
Affected
up to 6.9.8
What to do
Affects up to 6.9.8. Update BeePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Watermark RELOADED: Cross-Site Request Forgery (CSRF)CVE-2024-27195 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sverde1 Watermark RELOADED watermark-reloaded allows Cross Site Request Forgery.This issue affects Watermark RELOADED: from n/a through <= 1.3.5.
Product
Watermark RELOADED
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Watermark RELOADED to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Fontific | Google Fonts: Cross-Site Request Forgery (CSRF)CVE-2024-27194 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Andrei Ivasiuc Fontific | Google Fonts allows Stored XSS.This issue affects Fontific | Google Fonts: from n/a through 0.1.6.
Product
Fontific | Google Fonts
Affected
up to 0.1.6
What to do
Affects up to 0.1.6. Update Fontific | Google Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024ARI Stream Quiz: Cross-Site Request Forgery (CSRF)CVE-2023-51487 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32.
Product
ARI Stream Quiz
Affected
up to 1.2.32
What to do
Affects up to 1.2.32. Update ARI Stream Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024WooCommerce PDF Invoice Builder: Cross-Site Request Forgery (CSRF)CVE-2023-51486 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.101
What to do
Affects up to 1.2.101. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024TerraClassifieds: Cross-Site Request Forgery (CSRF)CVE-2023-51474 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3.
Product
TerraClassifieds
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update TerraClassifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Quiz And Survey Master: Cross-Site Request Forgery (CSRF)CVE-2023-51521 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.
Product
Quiz And Survey Master
Affected
up to 8.1.18
What to do
Affects up to 8.1.18. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Product Table by WBW: Cross Site Request Forgery (CSRF)CVE-2023-51512 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6.
Product
Product Table by WBW
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Export Media URLs: Cross-Site Request Forgery (CSRF)CVE-2023-51510 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0.
Product
Export Media URLs
Affected
up to 1.0
What to do
Affects up to 1.0. Update Export Media URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Depicter Slider: Cross-Site Request Forgery (CSRF)CVE-2023-51491 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6.
Product
Depicter Slider
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2023-51489 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
Product
Crowdsignal Dashboard – Polls, Surveys & more
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Split Test For Elementor: Cross-Site Request Forgery (CSRF)CVE-2023-51407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9.
Product
Split Test For Elementor
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Split Test For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Paid Member Subscriptions: Cross-Site Request Forgery (CSRF)CVE-2023-51522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.
Product
Paid Member Subscriptions
Affected
up to 2.10.4
What to do
Affects up to 2.10.4. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Customize My Account for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-51369 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from n/a through 1.8.3.
Product
Customize My Account for WooCommerce
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Customize My Account for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Legal Pages: Cross-Site Request Forgery (CSRF), Incorrect AuthorizationCVE-2023-50886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.
Product
Legal Pages
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024WP Simple Booking Calendar: Cross-Site Request Forgery (CSRF)CVE-2023-51525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.
Product
WP Simple Booking Calendar
Affected
up to 2.0.8.4
What to do
Affects up to 2.0.8.4. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2023-50861 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.
Product
HUSKY – Products Filter for WooCommerce (formerly WOOF)
Affected
up to 1.3.4.3
What to do
Affects up to 1.3.4.3. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: Cross-Site Request ForgeryCVE-2024-1642 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.6.0.1
What to do
Affects up to 4.6.0.1. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024SMS Alert Order Notifications – WooCommerce: Cross-Site Request ForgeryCVE-2024-1489 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attackers to delete pages and posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Comments Extra Fields For Post,Pages and CPT: Cross-Site Request ForgeryCVE-2024-0830 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. As a result, they may modify comment form fields and update plugin settings.
Product
Comments Extra Fields For Post,Pages and CPT
Affected
up to 5.0
What to do
Affects up to 5.0. Update Comments Extra Fields For Post,Pages and CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio: Cross-Site Request ForgeryCVE-2024-0827 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.4. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Related Posts for: Cross-Site Request ForgeryCVE-2024-0592 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handle_create_link() function. This makes it possible for unauthenticated attackers to add related posts to other posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This ultimately makes it possible for attackers to view draft and password protected posts.
Product
Related Posts for
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2024Team Circle Image Slider With Lightbox: Cross-Site Request Forgery in version 1CVE-2015-10130 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_func() function. This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScript, along with deleting images, and uploading malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Team Circle Image Slider With Lightbox
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Team Circle Image Slider With Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2024Bulgarisation for WooCommerce: Cross-Site Request ForgeryCVE-2024-2395 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to generate and delete labels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bulgarisation for WooCommerce
Affected
up to 3.0.14
What to do
Affects up to 3.0.14. Update Bulgarisation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.