Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 62 of 86
Dec 9, 2024Super Progressive Web Apps: Missing AuthorizationCVE-2023-48277 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.
- Product
- Super Progressive Web Apps
- Affected
- up to 2.2.21
- What to do
- Affects up to 2.2.21. Update Super Progressive Web Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WCMultiShipping: Missing AuthorizationCVE-2023-48274 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5.
- Product
- WCMultiShipping
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WCMultiShipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Contact Form to Any API: Missing AuthorizationCVE-2023-47871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.
- Product
- Contact Form to Any API
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024BlossomThemes Email Newsletter: Missing AuthorizationCVE-2023-47849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.
- Product
- BlossomThemes Email Newsletter
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024PayTR Taksit Tablosu: Missing AuthorizationCVE-2023-47847 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayTR Taksit Tablosu: from n/a through 1.3.1.
- Product
- PayTR Taksit Tablosu
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PayTR Taksit Tablosu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Analytify: Missing AuthorizationCVE-2023-47841 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Analytify Analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through 5.1.1.
- Product
- Analytify
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Conditional Fields for Contact Form 7: Missing AuthorizationCVE-2023-47838 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.1.
- Product
- Conditional Fields for Contact Form 7
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Meta and Date Remover: Missing AuthorizationCVE-2023-47836 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in prasadkirpekar WP Meta and Date Remover wp-meta-and-date-remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through <= 2.3.0.
- Product
- WP Meta and Date Remover
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Meta and Date Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024SearchIQ: Missing AuthorizationCVE-2023-47832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SearchIQ SearchIQ searchiq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through <= 4.4.
- Product
- SearchIQ
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Live Preview for Contact Form 7: Missing AuthorizationCVE-2023-47830 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0.
- Product
- Live Preview for Contact Form 7
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Live Preview for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Restaurant & Cafe Addon for Elementor: Missing AuthorizationCVE-2023-47826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.3.
- Product
- Restaurant & Cafe Addon for Elementor
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024FormCraft: Missing AuthorizationCVE-2023-47823 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7.
- Product
- FormCraft
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2023-47822 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.
- Product
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Affected
- up to 4.10
- What to do
- Affects up to 4.10. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Like Button: Missing AuthorizationCVE-2023-47820 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CRUDLab WP Like Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Like Button: from n/a through 1.7.0.
- Product
- WP Like Button
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update WP Like Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WPCafe: Missing AuthorizationCVE-2023-47805 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 2.2.22.
- Product
- WPCafe
- Affected
- up to 2.2.22
- What to do
- Affects up to 2.2.22. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Acme Fix Images: Missing AuthorizationCVE-2023-47793 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.
- Product
- Acme Fix Images
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Acme Fix Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024EasyAzon: Missing AuthorizationCVE-2023-47780 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flowdee EasyAzon easyazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through <= 5.1.0.
- Product
- EasyAzon
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update EasyAzon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024miniorange otp verification: Missing AuthorizationCVE-2023-47776 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.
- Product
- miniorange otp verification
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update miniorange otp verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Ditty: Missing AuthorizationCVE-2023-47764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.
- Product
- Ditty
- Affected
- up to 3.1.24
- What to do
- Affects up to 3.1.24. Update Ditty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Custom Admin Interface: Missing AuthorizationCVE-2023-47763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.31.
- Product
- WP Custom Admin Interface
- Affected
- up to 7.31
- What to do
- Affects up to 7.31. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024BetterDocs: Missing AuthorizationCVE-2023-47762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.
- Product
- BetterDocs
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Simple 301 Redirects by BetterLinks: Missing AuthorizationCVE-2023-47761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0.7.
- Product
- Simple 301 Redirects by BetterLinks
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Simple 301 Redirects by BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-47760 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Welcome Email Editor: Missing AuthorizationCVE-2023-47756 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.
- Product
- Welcome Email Editor
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Welcome Email Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Japanized For WooCommerce: Missing AuthorizationCVE-2023-47698 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.4.
- Product
- Japanized For WooCommerce
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Mini Cart Drawer For WooCommerce: Missing AuthorizationCVE-2023-47694 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.
- Product
- Mini Cart Drawer For WooCommerce
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Mini Cart Drawer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Ni WooCommerce Sales Report: Missing AuthorizationCVE-2023-32299 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Sales Report ni-woocommerce-sales-report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through <= 3.7.3.
- Product
- Ni WooCommerce Sales Report
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Ni WooCommerce Sales Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WRC Pricing Tables: Missing AuthorizationCVE-2023-32293 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7.
- Product
- WRC Pricing Tables
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update WRC Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024SALERT: Missing AuthorizationCVE-2023-32126 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPoperation SALERT allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALERT: from n/a through 1.2.1.
- Product
- SALERT
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update SALERT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-32117 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.
- Product
- Integrate Google Drive
- Affected
- up to 1.1.99
- What to do
- Affects up to 1.1.99. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Extended Post Status: Missing AuthorizationCVE-2023-32094 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.
- Product
- Extended Post Status
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Extended Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Quick Post Duplicator: Missing AuthorizationCVE-2023-31214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0.
- Product
- WP Quick Post Duplicator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
- Product
- Display custom fields in the frontend – Post and User Profile Fields
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Docs: Missing AuthorizationCVE-2023-30873 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.
- Product
- WP Docs
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sharkdropship for AliExpress Dropship and Affiliate: Missing AuthorizationCVE-2023-30870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3.
- Product
- Sharkdropship for AliExpress Dropship and Affiliate
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Sharkdropship for AliExpress Dropship and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Smart WooCommerce Search: Missing AuthorizationCVE-2023-30783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.
- Product
- Smart WooCommerce Search
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Smart WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Featured Post Creative: Missing AuthorizationCVE-2023-30488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.
- Product
- Featured Post Creative
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Square: Missing AuthorizationCVE-2023-30486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.
- Product
- Square
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stamped.io Product Reviews & UGC for WooCommerce: Missing AuthorizationCVE-2023-30479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.3.2.
- Product
- Stamped.io Product Reviews & UGC for WooCommerce
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Stamped.io Product Reviews & UGC for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
- Product
- Blogger Buzz
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024tencentcloud-cos: Missing AuthorizationCVE-2023-29433 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 腾讯云 tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7.
- Product
- tencentcloud-cos
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update tencentcloud-cos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024qTranslate X Cleanup and WPML Import: Missing AuthorizationCVE-2023-29431 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1.
- Product
- qTranslate X Cleanup and WPML Import
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update qTranslate X Cleanup and WPML Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024User Registration: Missing AuthorizationCVE-2023-29429 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 2.3.2.1.
- Product
- User Registration
- Affected
- up to 2.3.2.1
- What to do
- Affects up to 2.3.2.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Dynamics 365 Integration: Missing AuthorizationCVE-2023-29422 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13.
- Product
- Dynamics 365 Integration
- Affected
- up to 1.3.13
- What to do
- Affects up to 1.3.13. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024LuckyWP Scripts Control: Missing AuthorizationCVE-2023-29239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1.
- Product
- LuckyWP Scripts Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update LuckyWP Scripts Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Remove Duplicate Posts: Missing AuthorizationCVE-2023-29237 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5.
- Product
- Remove Duplicate Posts
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Remove Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Category Tree: Missing AuthorizationCVE-2023-29173 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.
- Product
- Product Category Tree
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Product Category Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024JS Job Manager: Missing AuthorizationCVE-2023-28689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.
- Product
- JS Job Manager
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Branded Social Images: Missing AuthorizationCVE-2023-28536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.
- Product
- Branded Social Images
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Branded Social Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Real Estate Directory: Missing AuthorizationCVE-2023-28532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5.
- Product
- Real Estate Directory
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.