Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
540 results · page 6 of 11
Feb 3, 2025Nirweb support: Authorization Bypass Through User-Controlled KeyCVE-2025-22695 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through <= 3.0.3.
- Product
- Nirweb support
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Nirweb support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploadedCVE-2024-13117 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded
- Product
- Social Share Buttons for
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Unauthorized accessCVE-2024-12253 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
- Product
- Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Reflected Cross-Site ScriptingCVE-2024-12128 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘monthly_sales_current_year’ parameter in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 1, 2024Paid Memberships Pro: Authorization Bypass Through User-Controlled KeyCVE-2024-37277 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.
- Product
- Paid Memberships Pro
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Meetup: Authorization Bypass Through User-Controlled KeyCVE-2024-50483 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a through <= 0.1.
- Product
- Meetup
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Meetup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Salon booking system: Authorization Bypass Through User-Controlled KeyCVE-2024-47316 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.This issue affects Salon booking system: from n/a through <= 10.9.
- Product
- Salon booking system
- Affected
- up to 10.9
- What to do
- Affects up to 10.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43916 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.102
- What to do
- Affects up to 3.3.102. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024Propovoice CRM: Authorization Bypass Through User-Controlled KeyCVE-2024-43350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Propovoice Propovoice CRM.This issue affects Propovoice CRM: from n/a through 1.7.6.4.
- Product
- Propovoice CRM
- Affected
- up to 1.7.6.4
- What to do
- Affects up to 1.7.6.4. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43322 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.100
- What to do
- Affects up to 3.3.100. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024Stripe Payments For WooCommerce by Checkout: Authorization Bypass Through User-Controlled KeyCVE-2024-43315 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
- Product
- Stripe Payments For WooCommerce by Checkout
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2024-43288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
- Product
- wpForo Forum
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2024-43266 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.
- Product
- WP Job Portal
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024Masteriyo - LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-43239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.4
- What to do
- Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024LearnPress: Authorization Bypass Through User-Controlled KeyCVE-2024-39642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LearnPress: from n/a through 4.2.6.8.2.
- Product
- LearnPress
- Affected
- up to 4.2.6.8.2
- What to do
- Affects up to 4.2.6.8.2. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 26, 2024During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests oCVE-2024-6490 · WordPress plugins & themes · reported by WPScanMedium 6.5
During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.
- Product
- Master Slider
- Affected
- up to 3.9.10
- What to do
- Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-38701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
- Product
- Academy LMS
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 15, 2024The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongingCVE-2024-3749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
- Product
- SP Project & Document Manager
- Affected
- up to 4.71
- What to do
- Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024SEOPress: Authorization Bypass Through User-Controlled KeyCVE-2024-34383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.
- Product
- SEOPress
- Affected
- up to 7.7.1
- What to do
- Affects up to 7.7.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2024Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1CVE-2024-33913 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Crelly Slider: Authorization Bypass Through User-Controlled KeyCVE-2024-33542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5.
- Product
- Crelly Slider
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Crelly Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Rate my Post – WP Rating System: Authorization Bypass Through User-Controlled KeyCVE-2024-32823 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4.
- Product
- Rate my Post – WP Rating System
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-32808 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
- Product
- ProfileGrid
- Affected
- up to 5.7.9
- What to do
- Affects up to 5.7.9. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-32772 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
- Product
- ProfileGrid
- Affected
- up to 5.7.9
- What to do
- Affects up to 5.7.9. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 19, 2024Wp Ultimate Review: Authorization Bypass Through User-Controlled KeyCVE-2024-32683 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
- Product
- Wp Ultimate Review
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 18, 2024WP-Recall: Authorization Bypass Through User-Controlled KeyCVE-2024-32604 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.
- Product
- WP-Recall
- Affected
- up to 16.26.5
- What to do
- Affects up to 16.26.5. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 7, 2024BookingPress: Authorization Bypass Through User-Controlled KeyCVE-2024-31296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
- Product
- BookingPress
- Affected
- up to 1.0.81
- What to do
- Affects up to 1.0.81. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 7, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-31291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
- Product
- ProfileGrid
- Affected
- up to 5.7.6
- What to do
- Affects up to 5.7.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 31, 2024Thumbs Rating: Authorization Bypass Through User-Controlled KeyCVE-2024-31095 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0.
- Product
- Thumbs Rating
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Thumbs Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 31, 2024Whizzy: Authorization Bypass Through User-Controlled KeyCVE-2024-30543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
- Product
- Whizzy
- Affected
- up to 1.1.18
- What to do
- Affects up to 1.1.18. Update Whizzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-30513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.
- Product
- ProfileGrid
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2024Molongui: Authorization Bypass Through User-Controlled KeyCVE-2024-30507 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
- Product
- Molongui
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 5, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site Scripting through editing contextCVE-2024-0954 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient input sanitization and output escaping on user supplied protocols. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 31, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Authorization Bypass Through User-Controlled KeyCVE-2024-22305 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
- Product
- Contact Form builder with drag & drop for WordPress – Kali Forms
- Affected
- up to 2.3.36
- What to do
- Affects up to 2.3.36. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 16, 2024EventON WordPress plugin through 4.5.8, EventON: Do not have authorisation in some AJAX actionsCVE-2024-0237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc
- Product
- EventON WordPress plugin through 4.5.8, EventON
- Affected
- up to 4.5.8
- Fixed in
- 2.2.7
- What to do
- Update EventON WordPress plugin through 4.5.8, EventON to 2.2.7 or newer.
Jan 5, 2024WooCommerce Stripe Payment Gateway: Authorization Bypass Through User-Controlled KeyCVE-2023-51502 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.
- Product
- WooCommerce Stripe Payment Gateway
- Affected
- up to 7.6.1
- What to do
- Affects up to 7.6.1. Update WooCommerce Stripe Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 31, 2023WooPayments – Fully Integrated Solution Built and Supported by Woo: Authorization Bypass Through User-Controlled KeyCVE-2023-51503 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.
- Product
- WooPayments – Fully Integrated Solution Built and Supported by Woo
- Affected
- up to 6.9.2
- What to do
- Affects up to 6.9.2. Update WooPayments – Fully Integrated Solution Built and Supported by Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023Rate my Post – WP Rating System: Authorization Bypass Through User-Controlled KeyCVE-2023-49765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.1.
- Product
- Rate my Post – WP Rating System
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Authorization Bypass Through User-Controlled KeyCVE-2023-47191 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.
- Product
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023Shipping Multiple Addresses: Authorization Bypass Through User-Controlled KeyCVE-2023-32799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.
- Product
- Shipping Multiple Addresses
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Shipping Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023WooCommerce Bookings: Authorization Bypass Through User-Controlled KeyCVE-2023-32747 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
- Product
- WooCommerce Bookings
- Affected
- up to 1.15.78
- What to do
- Affects up to 1.15.78. Update WooCommerce Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023WooPayments – Fully Integrated Solution Built and Supported by Woo: Authorization Bypass Through User-Controlled KeyCVE-2023-35916 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
- Product
- WooPayments – Fully Integrated Solution Built and Supported by Woo
- Affected
- up to 5.9.0
- What to do
- Affects up to 5.9.0. Update WooPayments – Fully Integrated Solution Built and Supported by Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Woo Subscriptions: Authorization Bypass Through User-Controlled KeyCVE-2023-35914 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
- Product
- Woo Subscriptions
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update Woo Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Editorial Calendar: Authorization Bypass Through User-Controlled KeyCVE-2023-36520 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.
- Product
- Editorial Calendar
- Affected
- up to 3.7.12
- What to do
- Affects up to 3.7.12. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023WooCommerce Square: Authorization Bypass Through User-Controlled KeyCVE-2023-35876 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
- Product
- WooCommerce Square
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update WooCommerce Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Comments – wpDiscuz: Authorization Bypass Through User-Controlled KeyCVE-2023-46311 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.6.3
- What to do
- Affects up to 7.6.3. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Sunshine Photo Cart: Free Client Galleries for Photographers: Authorization Bypass Through User-Controlled KeyCVE-2023-41796 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
- Product
- Sunshine Photo Cart: Free Client Galleries for Photographers
- Fixed in
- 3.0.0
- What to do
- Update Sunshine Photo Cart: Free Client Galleries for Photographers to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Photo Engine (Media Organizer & Lightroom): Authorization Bypass Through User-Controlled KeyCVE-2023-38513 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Affected
- up to 6.2.5
- What to do
- Affects up to 6.2.5. Update Photo Engine (Media Organizer & Lightroom) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023GoCardless: Authorization Bypass Through User-Controlled KeyCVE-2023-37871 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
- Product
- GoCardless
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update GoCardless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Stream: Authorization Bypass Through User-Controlled KeyCVE-2022-43450 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
- Product
- Stream
- Affected
- up to 3.9.2
- What to do
- Affects up to 3.9.2. Update Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.