Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 59 of 86
Dec 13, 2024Yet Another Stars Rating: Missing AuthorizationCVE-2023-39305 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through <= 3.4.3.
- Product
- Yet Another Stars Rating
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Yet Another Stars Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Social Share Icons & Social Share Buttons: Missing AuthorizationCVE-2023-38514 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7.
- Product
- Social Share Icons & Social Share Buttons
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Social Share Icons & Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Instant CSS: Missing AuthorizationCVE-2023-38483 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dylan Blokhuis Instant CSS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through 1.1.4.
- Product
- Instant CSS
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Instant CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Booster Elementor Addons: Missing AuthorizationCVE-2023-38480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Certain Dev Booster Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster Elementor Addons: from n/a through 1.4.9.
- Product
- Booster Elementor Addons
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Booster Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple Googlebot Visit: Missing AuthorizationCVE-2023-38479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codents Simple Googlebot Visit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Googlebot Visit: from n/a through 1.2.4.
- Product
- Simple Googlebot Visit
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Simple Googlebot Visit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024QR code MeCard/vCard generator: Missing AuthorizationCVE-2023-38477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0.
- Product
- QR code MeCard/vCard generator
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update QR code MeCard/vCard generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Donations Made Easy – Smart Donations: Missing AuthorizationCVE-2023-38475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
- Product
- Donations Made Easy – Smart Donations
- Affected
- up to 4.0.12
- What to do
- Affects up to 4.0.12. Update Donations Made Easy – Smart Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JupiterX Core: Missing AuthorizationCVE-2023-38385 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
- Product
- JupiterX Core
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Language: Missing AuthorizationCVE-2023-38383 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1.
- Product
- Language
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easyship WooCommerce Shipping Rates: Missing AuthorizationCVE-2023-37989 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Easyship Easyship WooCommerce Shipping Rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easyship WooCommerce Shipping Rates: from n/a through 0.9.0.
- Product
- Easyship WooCommerce Shipping Rates
- Affected
- up to 0.9.0
- What to do
- Affects up to 0.9.0. Update Easyship WooCommerce Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024YourMembership Single Sign On: Missing AuthorizationCVE-2023-37987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.
- Product
- YourMembership Single Sign On
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update YourMembership Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-37984 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.
- Product
- Quiz And Survey Master
- Affected
- up to 8.1.10
- What to do
- Affects up to 8.1.10. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WooCommerce Product Stock Alert: Missing AuthorizationCVE-2023-37971 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Checkout with Zelle on Woocommerce: Missing AuthorizationCVE-2023-37969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1.
- Product
- Checkout with Zelle on Woocommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Checkout with Zelle on Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024DirectoryPress: Missing AuthorizationCVE-2023-37967 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.
- Product
- DirectoryPress
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WPSchoolPress: Missing AuthorizationCVE-2023-37887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPSchoolPress Team WPSchoolPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through 2.2.7.
- Product
- WPSchoolPress
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Cryptocurrency Widgets – Price Ticker & Coins List: Missing AuthorizationCVE-2023-36681 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.2.
- Product
- Cryptocurrency Widgets – Price Ticker & Coins List
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Cryptocurrency Widgets – Price Ticker & Coins List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Image Regenerate & Select Crop: Missing AuthorizationCVE-2023-36680 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0.
- Product
- Image Regenerate & Select Crop
- Affected
- up to 7.1.0
- What to do
- Affects up to 7.1.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024LiquidPoll – Advanced Polls for Creators and Brands: Missing AuthorizationCVE-2023-36531 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68.
- Product
- LiquidPoll – Advanced Polls for Creators and Brands
- Affected
- up to 3.3.68
- What to do
- Affects up to 3.3.68. Update LiquidPoll – Advanced Polls for Creators and Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024kk Star Ratings: Missing AuthorizationCVE-2023-36528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3.
- Product
- kk Star Ratings
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update kk Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Duplicate Post Page Menu & Custom Post Type: Missing AuthorizationCVE-2023-36526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.
- Product
- Duplicate Post Page Menu & Custom Post Type
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Duplicate Post Page Menu & Custom Post Type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024SW Product Bundles: Missing AuthorizationCVE-2023-36519 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.
- Product
- SW Product Bundles
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update SW Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Post Hit Counter: Missing AuthorizationCVE-2023-36518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2.
- Product
- Post Hit Counter
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Post Hit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ReDi Restaurant Reservation: Missing AuthorizationCVE-2023-36510 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReDi Restaurant Reservation: from n/a through 23.0211.
- Product
- ReDi Restaurant Reservation
- Affected
- up to 23.0211
- What to do
- Affects up to 23.0211. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CHP Ads Block Detector: Missing AuthorizationCVE-2023-36509 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Suresh Chand CHP Ads Block Detector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CHP Ads Block Detector: from n/a through 3.9.5.
- Product
- CHP Ads Block Detector
- Affected
- up to 3.9.5
- What to do
- Affects up to 3.9.5. Update CHP Ads Block Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024YITH WooCommerce Waiting List: Missing AuthorizationCVE-2023-36506 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH WooCommerce Waiting List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through 2.13.0.
- Product
- YITH WooCommerce Waiting List
- Affected
- up to 2.13.0
- What to do
- Affects up to 2.13.0. Update YITH WooCommerce Waiting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Gutenverse: Missing AuthorizationCVE-2023-35875 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through 1.8.5.
- Product
- Gutenverse
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024The Events Calendar: Missing AuthorizationCVE-2023-35777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2.
- Product
- The Events Calendar
- Affected
- up to 6.1.2.2
- What to do
- Affects up to 6.1.2.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Directorist: Missing AuthorizationCVE-2023-35052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4.
- Product
- Directorist
- Affected
- up to 7.5.4
- What to do
- Affects up to 7.5.4. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Contact Forms by Cimatti: Missing AuthorizationCVE-2023-35051 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Dynamic Visibility for Elementor: Missing AuthorizationCVE-2023-35046 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5.
- Product
- Dynamic Visibility for Elementor
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Dynamic Visibility for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Surfer: Missing AuthorizationCVE-2023-35037 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.3.2.357.
- Product
- Surfer
- Affected
- up to 1.3.2.357
- What to do
- Affects up to 1.3.2.357. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Constant Contact Forms: Missing AuthorizationCVE-2023-34387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.
- Product
- Constant Contact Forms
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Constant Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Zippy: Missing AuthorizationCVE-2023-34381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.
- Product
- Zippy
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Change WooCommerce Add To Cart Button Text: Missing AuthorizationCVE-2023-34376 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3.
- Product
- Change WooCommerce Add To Cart Button Text
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Change WooCommerce Add To Cart Button Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Uncanny Toolkit for LearnDash: Missing AuthorizationCVE-2023-34019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.6.4.3
- What to do
- Affects up to 3.6.4.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Grid Plus: Missing AuthorizationCVE-2023-34014 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2.
- Product
- Grid Plus
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Grid Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Social Media & Share Icons: Missing AuthorizationCVE-2023-34009 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media & Share Icons: from n/a through 2.8.1.
- Product
- Social Media & Share Icons
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Social Media & Share Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Social Icons: Missing AuthorizationCVE-2023-33998 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Icons: from n/a through 3.2.5.
- Product
- Easy Social Icons
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Spam protection, AntiSpam, FireWall by CleanTalk: Missing AuthorizationCVE-2023-33996 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTalk: from n/a through 6.10.
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Affected
- up to 6.10
- What to do
- Affects up to 6.10. Update Spam protection, AntiSpam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2023-33995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.
- Product
- Photo Gallery by 10Web
- Affected
- up to 1.8.15
- What to do
- Affects up to 1.8.15. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Slimstat Analytics: Missing AuthorizationCVE-2023-33994 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slimstat Analytics: from n/a through <= 5.0.5.1.
- Product
- Slimstat Analytics
- Affected
- up to 5.0.5.1
- What to do
- Affects up to 5.0.5.1. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WordPress Backup & Migration: Missing AuthorizationCVE-2023-33928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.0.
- Product
- WordPress Backup & Migration
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Captcha: Missing AuthorizationCVE-2023-33324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wppal Easy Captcha allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Captcha: from n/a through 1.0.
- Product
- Easy Captcha
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Taggbox: Missing AuthorizationCVE-2023-33215 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Taggbox Taggbox taggbox-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through <= 3.3.
- Product
- Taggbox
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WooCommerce Predictive Search: Missing AuthorizationCVE-2023-32963 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in a3rev Software WooCommerce Predictive Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Predictive Search: from n/a through 5.8.0.
- Product
- WooCommerce Predictive Search
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update WooCommerce Predictive Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple Page Ordering: Missing AuthorizationCVE-2023-32798 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0.
- Product
- Simple Page Ordering
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Simple Page Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Booking Ultra Pro: Missing AuthorizationCVE-2023-32601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Booking Ultra Pro Booking Ultra Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Ultra Pro: from n/a through 1.1.12.
- Product
- Booking Ultra Pro
- Affected
- up to 1.1.12
- What to do
- Affects up to 1.1.12. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024reCAPTCHA for all: Missing AuthorizationCVE-2023-32599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bill Minozzi reCAPTCHA for all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects reCAPTCHA for all: from n/a through 1.22.
- Product
- reCAPTCHA for all
- Affected
- up to 1.22
- What to do
- Affects up to 1.22. Update reCAPTCHA for all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024GS Pins for Pinterest: Missing AuthorizationCVE-2023-32593 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in GS Plugins GS Pins for Pinterest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Pins for Pinterest: from n/a through 1.6.7.
- Product
- GS Pins for Pinterest
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update GS Pins for Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.