Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 57 of 86
Dec 31, 2024WP-CRM System: Missing AuthorizationCVE-2024-55991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.2.9.1.
- Product
- WP-CRM System
- Affected
- up to 3.2.9.1
- What to do
- Affects up to 3.2.9.1. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WooCommerce Subscriptions: Missing AuthorizationCVE-2023-50850 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Woo WooCommerce Subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Subscriptions: from n/a before 5.8.0.
- Product
- WooCommerce Subscriptions
- Fixed in
- 5.8.0
- What to do
- Update WooCommerce Subscriptions to 5.8.0 or newer.
Dec 31, 2024WP Cleanfix: Missing AuthorizationCVE-2023-48775 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gfazioli WP Cleanfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cleanfix: from n/a through 5.6.2.
- Product
- WP Cleanfix
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update WP Cleanfix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024VW Automobile Lite: Missing AuthorizationCVE-2024-56234 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through <= 2.1.
- Product
- VW Automobile Lite
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update VW Automobile Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Royal Elementor Addons: Missing AuthorizationCVE-2024-56227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.
- Product
- Royal Elementor Addons
- Affected
- up to 1.7.1001
- What to do
- Affects up to 1.7.1001. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Premium Addons for Elementor: Missing AuthorizationCVE-2024-56225 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.56.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.10.56
- What to do
- Affects up to 4.10.56. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Widget Options: Missing AuthorizationCVE-2024-56219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.6.1.
- Product
- Widget Options
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Download Manager: Missing AuthorizationCVE-2024-56217 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03.
- Product
- Download Manager
- Affected
- up to 3.3.03
- What to do
- Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Member Directory and Contact Form: Missing AuthorizationCVE-2024-56215 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Member Directory and Contact Form: from n/a through <= 1.7.0.
- Product
- Member Directory and Contact Form
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Member Directory and Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Userpro: Missing AuthorizationCVE-2024-56211 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2024WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor: Local File InclusionCVE-2024-12272 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024WPLMS: Missing AuthorizationCVE-2024-56048 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Advance Menu Manager: Missing AuthorizationCVE-2024-54381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Menu Manager: from n/a through <= 3.1.1.
- Product
- Advance Menu Manager
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Advance Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56008 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
- Product
- Spreadr Woocommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Order Delivery & Pickup Location Date Time: Missing AuthorizationCVE-2024-55997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through <= 1.1.0.
- Product
- Order Delivery & Pickup Location Date Time
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Order Delivery & Pickup Location Date Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024WP Menu Image: Missing AuthorizationCVE-2024-52485 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image wp-menu-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Menu Image: from n/a through <= 2.2.
- Product
- WP Menu Image
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Menu Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2024Accept Authorize.NET Payments Using Contact Form 7: Information ExposureCVE-2024-12250 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.
- Product
- Accept Authorize.NET Payments Using Contact Form 7
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 17, 2024Collapsing Categories: SQL InjectionCVE-2024-12025 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Collapsing Categories
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Collapsing Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2024Caldera SMTP Mailer: Missing AuthorizationCVE-2024-56003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Cramer Caldera SMTP Mailer caldera-smtp-mailer.This issue affects Caldera SMTP Mailer: from n/a through <= 1.0.1.
- Product
- Caldera SMTP Mailer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Caldera SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024XML Multilanguage Sitemap Generator: Missing AuthorizationCVE-2024-55999 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilanguage Sitemap Generator: from n/a through <= 2.0.6.
- Product
- XML Multilanguage Sitemap Generator
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update XML Multilanguage Sitemap Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Woffice: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-43234 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.
- Product
- Woffice
- Affected
- up to 5.4.14
- What to do
- Affects up to 5.4.14. Update Woffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wovax IDX: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-56013 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in wovax Wovax IDX wovax-idx allows Authentication Bypass.This issue affects Wovax IDX: from n/a through <= 1.2.2.
- Product
- Wovax IDX
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Wovax IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
- Product
- Spreadr Woocommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Leader: Missing AuthorizationCVE-2024-56007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in leader codes Leader leader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leader: from n/a through <= 2.6.1.
- Product
- Leader
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Leader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Easy Site Importer: Missing AuthorizationCVE-2024-56004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Site Importer: from n/a through <= 1.0.1.
- Product
- Easy Site Importer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Site Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Ksher: Missing AuthorizationCVE-2024-56001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through <= 1.1.1.
- Product
- Ksher
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Ksher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Popup Surveys & Polls for WordPress (Mare.io): Missing AuthorizationCVE-2024-55998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress (Mare.io): from n/a through <= 1.36.
- Product
- Popup Surveys & Polls for WordPress (Mare.io)
- Affected
- up to 1.36
- What to do
- Affects up to 1.36. Update Popup Surveys & Polls for WordPress (Mare.io) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
- Product
- Dreamfox Media Payment gateway per Product for Woocommerce
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024畅言评论系统: Missing AuthorizationCVE-2024-55994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sohu 畅言评论系统 changyan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 畅言评论系统: from n/a through <= 2.0.5.
- Product
- 畅言评论系统
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update 畅言评论系统 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Job Board Manager: Missing AuthorizationCVE-2024-55993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WooCommerce Basic Ordernumbers: Missing AuthorizationCVE-2024-55992 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Basic Ordernumbers: from n/a through <= 1.4.4.
- Product
- WooCommerce Basic Ordernumbers
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WooCommerce Basic Ordernumbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024PixProof: Missing AuthorizationCVE-2024-54417 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.
- Product
- PixProof
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update PixProof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Arabic Webfonts: Missing AuthorizationCVE-2024-54402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arabic Webfonts: from n/a through <= 1.4.6.
- Product
- Arabic Webfonts
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Arabic Webfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2024-54384 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anh Tran Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through <= 2.8.3.
- Product
- Falcon – WordPress Optimizations & Tweaks
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Minterpress: Missing AuthorizationCVE-2024-54379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Quietly Insights: Missing AuthorizationCVE-2024-54378 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through <= 1.2.2.
- Product
- Quietly Insights
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Quietly Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Zita Site Builder: Missing AuthorizationCVE-2024-54369 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.
- Product
- Zita Site Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Zita Site Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Banner System: Missing AuthorizationCVE-2024-54359 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Saul Morales Pacheco Banner System banner-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Banner System: from n/a through <= 1.0.0.
- Product
- Banner System
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Banner System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Termin-Kalender: Missing AuthorizationCVE-2024-54354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in beat.k Termin-Kalender termin-kalender allows Stored XSS.This issue affects Termin-Kalender: from n/a through <= 0.99.47.
- Product
- Termin-Kalender
- Affected
- up to 0.99.47
- What to do
- Affects up to 0.99.47. Update Termin-Kalender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Events Calendar: Is missing access checks in the REST APICVE-2024-5333 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
- Product
- Events Calendar
- Fixed in
- 6.8.2.1
- What to do
- Update Events Calendar to 6.8.2.1 or newer.
Dec 13, 2024Projectopia: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54336 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Projectopia Projectopia projectopia-core allows Authentication Bypass.This issue affects Projectopia: from n/a through <= 5.1.7.
- Product
- Projectopia
- Affected
- up to 5.1.7
- What to do
- Affects up to 5.1.7. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024GEO my: Missing AuthorizationCVE-2024-54326 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through <= 4.5.0.4.
- Product
- GEO my
- Affected
- up to 4.5.0.4
- What to do
- Affects up to 4.5.0.4. Update GEO my to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024New User Approve: Missing AuthorizationCVE-2024-54323 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 2.6.2.
- Product
- New User Approve
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mark New Posts: Missing AuthorizationCVE-2024-54311 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in i.lychkov Mark New Posts mark-new-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark New Posts: from n/a through <= 7.5.1.
- Product
- Mark New Posts
- Affected
- up to 7.5.1
- What to do
- Affects up to 7.5.1. Update Mark New Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Gou Manage My Account Menu: Missing AuthorizationCVE-2024-54310 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu gou-wc-account-tabs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through <= 1.0.1.8.
- Product
- Gou Manage My Account Menu
- Affected
- up to 1.0.1.8
- What to do
- Affects up to 1.0.1.8. Update Gou Manage My Account Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Car Dealer: Missing AuthorizationCVE-2024-54298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through <= 4.46.
- Product
- Car Dealer
- Affected
- up to 4.46
- What to do
- Affects up to 4.46. Update Car Dealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024vBSSO-lite: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54297 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.
- Product
- vBSSO-lite
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update vBSSO-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CoSchool LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54296 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
- Product
- CoSchool LMS
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update CoSchool LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ListApp Mobile Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54295 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.
- Product
- ListApp Mobile Manager
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update ListApp Mobile Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Firebase OTP Authentication: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54294 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1.
- Product
- Firebase OTP Authentication
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Firebase OTP Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.