Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 64 of 86
Dec 6, 2024WP Mailster: Missing AuthorizationCVE-2024-53805 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in brandtoss WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP Mailster: Missing AuthorizationCVE-2024-53803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in brandtoss WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024FloristPress: Missing AuthorizationCVE-2024-53799 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through <= 7.3.0.
- Product
- FloristPress
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update FloristPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Church Admin: Missing AuthorizationCVE-2024-53795 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Church Admin: from n/a through <= 5.0.8.
- Product
- Church Admin
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Smart Marketing SMS and Newsletters Forms: Missing AuthorizationCVE-2024-53784 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Marketing SMS and Newsletters Forms: from n/a through <= 5.0.4.
- Product
- Smart Marketing SMS and Newsletters Forms
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024AI Quiz: Missing AuthorizationCVE-2024-53708 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kekotron AI Quiz ai-quiz allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AI Quiz: from n/a through <= 1.1.
- Product
- AI Quiz
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AI Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Wawp: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-52475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This issue affects Wawp: from n/a through < 3.0.18.
- Product
- Wawp
- What to do
- Update Wawp to the newest version.
Nov 20, 2024de:branding: Missing Authentication for Critical FunctionCVE-2024-52438 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authentication for Critical Function vulnerability in deco.agency de:branding debranding allows Privilege Escalation.This issue affects de:branding: from n/a through <= 1.0.2.
- Product
- de:branding
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update de:branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Banner System: Missing Authentication for Critical FunctionCVE-2024-52437 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System banner-system allows Privilege Escalation.This issue affects Banner System: from n/a through <= 1.0.0.
- Product
- Banner System
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Banner System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Floating Buttons for WooCommerce: Missing AuthorizationCVE-2024-52395 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud Floating Buttons for WooCommerce shop-assistant-for-woocommerce-jarvis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Floating Buttons for WooCommerce: from n/a through <= 2.8.8.
- Product
- Floating Buttons for WooCommerce
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update Floating Buttons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Browsing History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama Browsing History browsing-history allows Stored XSS.This issue affects Browsing History: from n/a through <= 1.3.1.
- Product
- Browsing History
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Browsing History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Combo WP Rewrite Slugs: Missing AuthorizationCVE-2024-51817 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodeZel Combo WP Rewrite Slugs combo-wp-rewrite-slugs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Combo WP Rewrite Slugs: from n/a through <= 1.0.
- Product
- Combo WP Rewrite Slugs
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Combo WP Rewrite Slugs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Otter - Gutenberg Block: Missing AuthorizationCVE-2024-51671 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Otter - Gutenberg Block: from n/a through <= 3.0.3.
- Product
- Otter - Gutenberg Block
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Otter - Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Easy Accordion Gutenberg Block: Missing AuthorizationCVE-2024-51660 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Binsaifullah Easy Accordion Gutenberg Block easy-accordion-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Accordion Gutenberg Block: from n/a through <= 1.2.3.
- Product
- Easy Accordion Gutenberg Block
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy Accordion Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Bold Page Builder: Missing AuthorizationCVE-2024-50417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Page Builder: from n/a through <= 5.1.3.
- Product
- Bold Page Builder
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-49697 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024HD Quiz – Save Results Light: Missing AuthorizationCVE-2024-49689 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Harmonic Design HD Quiz – Save Results Light hd-quiz-save-results-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz – Save Results Light: from n/a through <= 0.5.
- Product
- HD Quiz – Save Results Light
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update HD Quiz – Save Results Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024WP VR: Missing AuthorizationCVE-2024-49680 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.5.
- Product
- WP VR
- Affected
- up to 8.5.5
- What to do
- Affects up to 8.5.5. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Elfsight Telegram Chat CC: Unauthorized modification of data to a missing capability check on the 'updatePreferences' functionCVE-2024-10390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Elfsight Telegram Chat CC
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Elfsight Telegram Chat CC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 16, 2024Debug Tool: Missing AuthorizationCVE-2024-52416 · WordPress plugins & themes · reported by PatchstackCritical 10
Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a through <= 2.2.
- Product
- Debug Tool
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Debug Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Login using WordPress Users ( WP as SAML IDP ): Time-based SQL InjectionCVE-2024-9887 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Login using WordPress Users ( WP as SAML IDP )
- Affected
- up to 1.15.6
- What to do
- Affects up to 1.15.6. Update Login using WordPress Users ( WP as SAML IDP ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 15, 2024Simple Local Avatars: Unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache functionCVE-2024-10786 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.
- Product
- Simple Local Avatars
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update Simple Local Avatars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2024Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Missing AuthorizationCVE-2024-52383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.1.2.
- Product
- Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Matix Popup Builder: Missing AuthorizationCVE-2024-52382 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in medmatech Matix Popup Builder medma-matix allows Privilege Escalation.This issue affects Matix Popup Builder: from n/a through <= 1.0.0.
- Product
- Matix Popup Builder
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Matix Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statementCVE-2024-9186 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- Fixed in
- 3.3.0
- What to do
- Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to 3.3.0 or newer.
Nov 9, 2024Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Reflected Cross-Site ScriptingCVE-2024-10876 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.8.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Happy Addons for Elementor: Missing AuthorizationCVE-2024-48045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.3.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.12.3
- What to do
- Affects up to 3.12.3. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ShortPixel Image Optimizer: Missing AuthorizationCVE-2024-48044 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
- Product
- ShortPixel Image Optimizer
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024CubeWP: Missing AuthorizationCVE-2024-48039 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP: from n/a through <= 1.1.15.
- Product
- CubeWP
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Strong Testimonials: Missing AuthorizationCVE-2024-47362 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
- Product
- Strong Testimonials
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Elementor Addon Elements: Missing AuthorizationCVE-2024-47361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.
- Product
- Elementor Addon Elements
- Affected
- up to 1.13.6
- What to do
- Affects up to 1.13.6. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Popup Maker: Missing AuthorizationCVE-2024-47358 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.
- Product
- Popup Maker
- Affected
- up to 1.19.2
- What to do
- Affects up to 1.19.2. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Datepicker: Missing AuthorizationCVE-2024-47321 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.
- Product
- WP Datepicker
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024PWA for WP & AMP: Missing AuthorizationCVE-2024-47318 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.
- Product
- PWA for WP & AMP
- Affected
- up to 1.7.72
- What to do
- Affects up to 1.7.72. Update PWA for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ads by WPQuads: Missing AuthorizationCVE-2024-47317 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84.
- Product
- Ads by WPQuads
- Affected
- up to 2.0.84
- What to do
- Affects up to 2.0.84. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-47314 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.8.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Wheel of Life: Missing AuthorizationCVE-2024-47311 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.1.8.
- Product
- Wheel of Life
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Wheel of Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Templately: Missing AuthorizationCVE-2024-47308 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.
- Product
- Templately
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Fluent Support: Missing AuthorizationCVE-2024-47302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.8.0.
- Product
- Fluent Support
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Fluent Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024HelloAsso: Missing AuthorizationCVE-2024-44052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.
- Product
- HelloAsso
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-44038 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JoomSport: Missing AuthorizationCVE-2024-44031 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.
- Product
- JoomSport
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update JoomSport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Truepush: Missing AuthorizationCVE-2024-44021 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8.
- Product
- Truepush
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Truepush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: Missing AuthorizationCVE-2024-44020 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.
- Product
- WP Free SSL – Free SSL Certificate for WordPress and force HTTPS
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WP Free SSL – Free SSL Certificate for WordPress and force HTTPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Contact Form 7 Campaign Monitor Extension: Missing AuthorizationCVE-2024-44019 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.
- Product
- Contact Form 7 Campaign Monitor Extension
- Affected
- up to 0.4.67
- What to do
- Affects up to 0.4.67. Update Contact Form 7 Campaign Monitor Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WooCommerce Multilingual & Multicurrency: Missing AuthorizationCVE-2024-44006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through <= 5.3.6.
- Product
- WooCommerce Multilingual & Multicurrency
- Affected
- up to 5.3.6
- What to do
- Affects up to 5.3.6. Update WooCommerce Multilingual & Multicurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Blogpoet: Missing AuthorizationCVE-2024-43998 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.
- Product
- Blogpoet
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Blogpoet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Login As Users: Missing AuthorizationCVE-2024-43982 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3.
- Product
- Login As Users
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024GeoDirectory: Missing AuthorizationCVE-2024-43981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
- Product
- GeoDirectory
- Affected
- up to 2.3.70
- What to do
- Affects up to 2.3.70. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Fota WP: Missing AuthorizationCVE-2024-43980 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.
- Product
- Fota WP
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Fota WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.