Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 61 of 86
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-51360 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-51359 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Conversios.io: Missing AuthorizationCVE-2023-51357 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 6.5.0.
- Product
- Conversios.io
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024MultiVendorX: Missing AuthorizationCVE-2023-51355 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through <= 4.0.23.
- Product
- MultiVendorX
- Affected
- up to 4.0.23
- What to do
- Affects up to 4.0.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-51353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through <= 1.10.19.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.19
- What to do
- Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Poll Maker: Missing AuthorizationCVE-2023-50904 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.8.0.
- Product
- Poll Maker
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Metform: Missing AuthorizationCVE-2023-50903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.
- Product
- Metform
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2023-50899 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.2.
- Product
- Product Catalog Enquiry for WooCommerce by MultiVendorX
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024User Feedback: Missing AuthorizationCVE-2023-50887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.0.10.
- Product
- User Feedback
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2023-50884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.1.5.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-50882 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2.
- Product
- ProfilePress
- Affected
- up to 4.13.2
- What to do
- Affects up to 4.13.2. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Filter by WBW: Missing AuthorizationCVE-2023-50877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0.
- Product
- Product Filter by WBW
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Molongui: Missing AuthorizationCVE-2023-50876 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Molongui: from n/a through 4.7.3.
- Product
- Molongui
- Affected
- up to 4.7.3
- What to do
- Affects up to 4.7.3. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Google Language Translator: Missing AuthorizationCVE-2023-50375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in edo888 Google Language Translator google-language-translator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Language Translator: from n/a through <= 6.0.19.
- Product
- Google Language Translator
- Affected
- up to 6.0.19
- What to do
- Affects up to 6.0.19. Update Google Language Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Alt Manager: Missing AuthorizationCVE-2023-50373 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through <= 1.6.1.
- Product
- Alt Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Alt Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Social Media Feather: Missing AuthorizationCVE-2023-49861 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in socialmediafeather Social Media Feather social-media-feather allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media Feather: from n/a through <= 2.1.3.
- Product
- Social Media Feather
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Social Media Feather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Login With Ajax: Missing AuthorizationCVE-2023-49859 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marcus (aka @msykes) Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through <= 4.1.
- Product
- Login With Ajax
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Login With Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Custom Login: Missing AuthorizationCVE-2023-49858 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Austin Custom Login custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login: from n/a through <= 4.1.0.
- Product
- Custom Login
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-49857 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.7.
- Product
- Awesome Support
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Smart Forms: Missing AuthorizationCVE-2023-49856 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84.
- Product
- Smart Forms
- Affected
- up to 2.6.84
- What to do
- Affects up to 2.6.84. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Square Thumbnails: Missing AuthorizationCVE-2023-49851 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ILMDESIGNS Square Thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square Thumbnails: from n/a through 1.1.1.
- Product
- Square Thumbnails
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Square Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Simple HTML Sitemap: Missing AuthorizationCVE-2023-49850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through 2.7.
- Product
- WP Simple HTML Sitemap
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Shortcoder: Missing AuthorizationCVE-2023-49849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in vaakash Shortcoder shortcoder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcoder: from n/a through <= 6.3.
- Product
- Shortcoder
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update Shortcoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2023-49848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy woo-aliexpress-dropshipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through <= 2.1.1.
- Product
- Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Redirects: Missing AuthorizationCVE-2023-49845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mattdeclaire Redirects redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirects: from n/a through <= 1.2.1.
- Product
- Redirects
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Post Duplicator: Missing AuthorizationCVE-2023-49835 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31.
- Product
- Post Duplicator
- Affected
- up to 2.31
- What to do
- Affects up to 2.31. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Site Reviews: Missing AuthorizationCVE-2023-49832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through <= 6.10.2.
- Product
- Site Reviews
- Affected
- up to 6.10.2
- What to do
- Affects up to 6.10.2. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024RegistrationMagic: Missing AuthorizationCVE-2023-49831 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 5.2.3.0.
- Product
- RegistrationMagic
- Affected
- up to 5.2.3.0
- What to do
- Affects up to 5.2.3.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Webflow Pages: Missing AuthorizationCVE-2023-49818 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Webflow Webflow Pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webflow Pages: from n/a through 1.0.8.
- Product
- Webflow Pages
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Webflow Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Flexible Woocommerce Checkout Field Editor: Missing AuthorizationCVE-2023-49817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
- Product
- Flexible Woocommerce Checkout Field Editor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Flexible Woocommerce Checkout Field Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Booking System: Missing AuthorizationCVE-2023-49758 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Roland Murg WP Booking System wp-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Booking System: from n/a through <= 2.0.19.2.
- Product
- WP Booking System
- Affected
- up to 2.0.19.2
- What to do
- Affects up to 2.0.19.2. Update WP Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-49757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.10.
- Product
- Awesome Support
- Affected
- up to 6.1.10
- What to do
- Affects up to 6.1.10. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Eventin: Missing AuthorizationCVE-2023-49756 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventin: from n/a through <= 3.3.52.
- Product
- Eventin
- Affected
- up to 3.3.52
- What to do
- Affects up to 3.3.52. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Elementor Timeline Widget: Missing AuthorizationCVE-2023-49755 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2.
- Product
- Elementor Timeline Widget
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Elementor Timeline Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Bulk Edit Post Titles: Missing AuthorizationCVE-2023-49754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Yogesh Pawar Bulk Edit Post Titles bulk-edit-post-titles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Edit Post Titles: from n/a through <= 5.0.0.
- Product
- Bulk Edit Post Titles
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Bulk Edit Post Titles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024PageLayer: Missing AuthorizationCVE-2023-49196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7.
- Product
- PageLayer
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Hubbub Lite: Missing AuthorizationCVE-2023-49193 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NerdPress Hubbub Lite social-pug allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hubbub Lite: from n/a through <= 1.30.0.
- Product
- Hubbub Lite
- Affected
- up to 1.30.0
- What to do
- Affects up to 1.30.0. Update Hubbub Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Enhanced Text Widget: Missing AuthorizationCVE-2023-49192 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cl272 Enhanced Text Widget enhanced-text-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through <= 1.6.3.
- Product
- Enhanced Text Widget
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Enhanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Database for CF7: Missing AuthorizationCVE-2023-49167 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in code4life Database for CF7 database-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database for CF7: from n/a through <= 1.2.4.
- Product
- Database for CF7
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Database for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024GoDaddy Email Marketing: Missing AuthorizationCVE-2023-49156 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoDaddy GoDaddy Email Marketing godaddy-email-marketing-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDaddy Email Marketing: from n/a through <= 1.4.3.
- Product
- GoDaddy Email Marketing
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update GoDaddy Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Button Generator – easily Button Builder: Missing AuthorizationCVE-2023-49154 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.
- Product
- Button Generator – easily Button Builder
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024360 Javascript Viewer: Missing AuthorizationCVE-2023-48779 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 3DWeb 360 Javascript Viewer 360deg-javascript-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript Viewer: from n/a through <= 1.7.11.
- Product
- 360 Javascript Viewer
- Affected
- up to 1.7.11
- What to do
- Affects up to 1.7.11. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024canvasio3D Light: Missing AuthorizationCVE-2023-48776 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in virtuellwerk canvasio3D Light canvasio3d-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects canvasio3D Light: from n/a through <= 2.5.0.
- Product
- canvasio3D Light
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update canvasio3D Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024IdeaPush: Missing AuthorizationCVE-2023-48774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Martin Gibson IdeaPush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through n/a.
- Product
- IdeaPush
- Fixed in
- 8.58
- What to do
- Update IdeaPush to 8.58 or newer.
Dec 9, 2024Void Elementor Post Grid Addon for Elementor Page builder: Missing AuthorizationCVE-2023-48750 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in voidthemes Void Elementor Post Grid Addon for Elementor Page builder void-elementor-post-grid-addon-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through <= 2.1.10.
- Product
- Void Elementor Post Grid Addon for Elementor Page builder
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Social Feed: Missing AuthorizationCVE-2023-48740 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sajid Javed Easy Social Feed easy-facebook-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Feed: from n/a through <= 6.5.1.
- Product
- Easy Social Feed
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update Easy Social Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Mail Bank - #1 Mail SMTP Plugin for: Missing AuthorizationCVE-2023-48332 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress wp-mail-bank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mail Bank - #1 Mail SMTP Plugin for WordPress: from n/a through <= 4.0.14.
- Product
- Mail Bank - #1 Mail SMTP Plugin for
- Affected
- up to 4.0.14
- What to do
- Affects up to 4.0.14. Update Mail Bank - #1 Mail SMTP Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-48324 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.4.
- Product
- Awesome Support
- Affected
- up to 6.1.4
- What to do
- Affects up to 6.1.4. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024TextMe SMS: Missing AuthorizationCVE-2023-48287 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.0.
- Product
- TextMe SMS
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update TextMe SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stripe Payments: Missing AuthorizationCVE-2023-48286 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in mra13 Stripe Payments stripe-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through <= 2.0.79.
- Product
- Stripe Payments
- Affected
- up to 2.0.79
- What to do
- Affects up to 2.0.79. Update Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.