Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 63 of 86
Dec 9, 2024Dynamics 365 Integration: Missing AuthorizationCVE-2023-28417 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.
- Product
- Dynamics 365 Integration
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Chankhe: Missing AuthorizationCVE-2023-28416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5.
- Product
- Chankhe
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Chankhe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Console: Missing AuthorizationCVE-2023-28168 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9.
- Product
- WordPress Console
- Affected
- up to 0.3.9
- What to do
- Affects up to 0.3.9. Update WordPress Console to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Backup Bank: WordPress Backup: Missing AuthorizationCVE-2023-28165 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: from n/a through 4.0.28.
- Product
- Backup Bank: WordPress Backup
- Affected
- up to 4.0.28
- What to do
- Affects up to 4.0.28. Update Backup Bank: WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Stock Ticker: Missing AuthorizationCVE-2023-27626 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aleksandar Urošević Stock Ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Ticker: from n/a through 3.23.0.
- Product
- Stock Ticker
- Affected
- up to 3.23.0
- What to do
- Affects up to 3.23.0. Update Stock Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Site Reviews: Missing AuthorizationCVE-2023-27625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.5.0.
- Product
- Site Reviews
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Rife Elementor Extensions & Templates: Missing AuthorizationCVE-2023-27454 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.
- Product
- Rife Elementor Extensions & Templates
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Total Poll Lite: Missing AuthorizationCVE-2023-27449 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through 4.8.6.
- Product
- Total Poll Lite
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP users media: Missing AuthorizationCVE-2023-27428 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP users media: from n/a through 4.2.3.
- Product
- WP users media
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WP users media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Repost: Missing AuthorizationCVE-2023-26522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1.
- Product
- WP Repost
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP Repost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Advanced Text Widget: Missing AuthorizationCVE-2023-26520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2.
- Product
- Advanced Text Widget
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Advanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Top 10: Missing AuthorizationCVE-2023-25993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: from n/a through 3.2.3.
- Product
- Top 10
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Top 10 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Filebird: Missing AuthorizationCVE-2023-25966 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.
- Product
- Filebird
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Apollo13 Framework Extensions: Missing AuthorizationCVE-2023-25959 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.8.10
- What to do
- Affects up to 1.8.10. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fontiran: Missing AuthorizationCVE-2023-25791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran: from n/a through 2.1.
- Product
- Fontiran
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Fontiran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Paypal Payments: Missing AuthorizationCVE-2023-25714 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
- Product
- Quick Paypal Payments
- Affected
- up to 5.7.25
- What to do
- Affects up to 5.7.25. Update Quick Paypal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Meta slider and carousel with lightbox: Missing AuthorizationCVE-2023-25703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2.
- Product
- Meta slider and carousel with lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Clone: Missing AuthorizationCVE-2023-25486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7.
- Product
- Clone
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Table of Contents: Missing AuthorizationCVE-2023-25469 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2.
- Product
- Easy Table of Contents
- Affected
- up to 2.0.45.2
- What to do
- Affects up to 2.0.45.2. Update Easy Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-25455 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Protected Posts Logout Button: Missing AuthorizationCVE-2023-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5.
- Product
- Protected Posts Logout Button
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Protected Posts Logout Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024We’re Open!: Missing AuthorizationCVE-2023-25067 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Noah Hearle, Design Extreme We’re Open! allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects We’re Open!: from n/a through 1.45.
- Product
- We’re Open!
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update We’re Open! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Album and Image Gallery plus Lightbox: Missing AuthorizationCVE-2023-25060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through 1.6.2.
- Product
- Album and Image Gallery plus Lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Album and Image Gallery plus Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fantastic Content Protector Free: Missing AuthorizationCVE-2023-25048 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fantastic Content Protector Free: from n/a through 2.6.
- Product
- Fantastic Content Protector Free
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Fantastic Content Protector Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Booking Calendar Contact Form: Missing AuthorizationCVE-2023-25037 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.
- Product
- Booking Calendar Contact Form
- Affected
- up to 1.2.34
- What to do
- Affects up to 1.2.34. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Contact Form: Missing AuthorizationCVE-2023-25035 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8.0.3.1.
- Product
- Quick Contact Form
- Affected
- up to 8.0.3.1
- What to do
- Affects up to 8.0.3.1. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024PayPal Brasil para WooCommerce: Missing AuthorizationCVE-2023-25026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.
- Product
- PayPal Brasil para WooCommerce
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update PayPal Brasil para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2023-24407 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-24375 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.5.14
- What to do
- Affects up to 7.5.14. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Reviews and Rating – Google My Business: Missing AuthorizationCVE-2023-23986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.14.
- Product
- Reviews and Rating – Google My Business
- Affected
- up to 4.14
- What to do
- Affects up to 4.14. Update Reviews and Rating – Google My Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Quick Event Manager: Missing AuthorizationCVE-2023-23975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4.
- Product
- Quick Event Manager
- Affected
- up to 9.7.4
- What to do
- Affects up to 9.7.4. Update Quick Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2023-23895 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.1.82
- What to do
- Affects up to 1.1.82. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Simple Giveaways: Missing AuthorizationCVE-2023-23893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0.
- Product
- Simple Giveaways
- Affected
- up to 2.48.0
- What to do
- Affects up to 2.48.0. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Google Analytics for: Missing AuthorizationCVE-2023-23887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0.
- Product
- Easy Google Analytics for
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Easy Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP-RecentComments: Missing AuthorizationCVE-2023-23886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7.
- Product
- WP-RecentComments
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update WP-RecentComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Cost of Goods for WooCommerce: Missing AuthorizationCVE-2023-23868 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.
- Product
- Cost of Goods for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Cost of Goods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Spectra: Missing AuthorizationCVE-2023-23834 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
- Product
- Spectra
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Spectra: Missing AuthorizationCVE-2023-23825 · WordPress plugins & themes · reported by PatchstackLow 3.1
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
- Product
- Spectra
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Enhanced Text Widget: Missing AuthorizationCVE-2023-23823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8.
- Product
- Enhanced Text Widget
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Enhanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024CP Multi View Event Calendar: Missing AuthorizationCVE-2023-23814 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through 1.4.13.
- Product
- CP Multi View Event Calendar
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Shortcodes: Missing AuthorizationCVE-2023-23725 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes: from n/a through 3.46.
- Product
- Shortcodes
- Affected
- up to 3.46
- What to do
- Affects up to 3.46. Update Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Zendesk Support for: Missing AuthorizationCVE-2023-23716 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4.
- Product
- Zendesk Support for
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Zendesk Support for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024JobBoardWP – Job Board Listings and Submissions: Missing AuthorizationCVE-2023-23715 · WordPress plugins & themes · reported by PatchstackMedium 5.2
Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.2.
- Product
- JobBoardWP – Job Board Listings and Submissions
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update JobBoardWP – Job Board Listings and Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Kraken.io Image Optimizer: Missing AuthorizationCVE-2023-22708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7.
- Product
- Kraken.io Image Optimizer
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update Kraken.io Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Ebook Store: Missing AuthorizationCVE-2023-22701 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Shopfiles Ltd Ebook Store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ebook Store: from n/a through 5.775.
- Product
- Ebook Store
- Affected
- up to 5.775
- What to do
- Affects up to 5.775. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WPCasa: Missing AuthorizationCVE-2024-53826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPSight WPCasa wpcasa allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPCasa: from n/a through <= 1.2.13.
- Product
- WPCasa
- Affected
- up to 1.2.13
- What to do
- Affects up to 1.2.13. Update WPCasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Filebird: Missing AuthorizationCVE-2024-53825 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.3.2.
- Product
- Filebird
- Affected
- up to 6.3.2
- What to do
- Affects up to 6.3.2. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP Travel: Missing AuthorizationCVE-2024-53813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 9.6.0.
- Product
- WP Travel
- Affected
- up to 9.6.0
- What to do
- Affects up to 9.6.0. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Simple User Registration: Missing AuthorizationCVE-2024-53810 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in N-Media Simple User Registration wp-registration allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Simple User Registration: from n/a through <= 5.5.
- Product
- Simple User Registration
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Maspik – Spam blacklist: Missing AuthorizationCVE-2024-53806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in yonifre Maspik – Spam blacklist contact-forms-anti-spam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Maspik – Spam blacklist: from n/a through <= 2.2.7.
- Product
- Maspik – Spam blacklist
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Maspik – Spam blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.