Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

3,863 results · page 64 of 78

Dec 26, 2023The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tagCVE-2023-6250 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
Product
BestWebSoft's Like & Share
Fixed in
2.74
What to do
Update BestWebSoft's Like & Share to 2.74 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2023BigCommerce For: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49162 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigCommerce For WordPress: from n/a through 5.0.6.
Product
BigCommerce For
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update BigCommerce For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WordPress Job Board and Recruitment Plugin – JobWP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48288 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.1.
Product
WordPress Job Board and Recruitment Plugin – JobWP
Affected
up to 2.1
What to do
Affects up to 2.1. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-2487 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WordPress Email Marketing Plugin – WP Email Capture: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-28421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects WordPress Email Marketing Plugin – WP Email Capture: from n/a through 3.10.
Product
WordPress Email Marketing Plugin – WP Email Capture
Affected
up to 3.10
What to do
Affects up to 3.10. Update WordPress Email Marketing Plugin – WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023AppMySite – Create an app with the Best Mobile App Builder: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49762 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AppMySite AppMySite – Create an app with the Best Mobile App Builder.This issue affects AppMySite – Create an app with the Best Mobile App Builder: from n/a through 3.11.0.
Product
AppMySite – Create an app with the Best Mobile App Builder
Affected
up to 3.11.0
What to do
Affects up to 3.11.0. Update AppMySite – Create an app with the Best Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Popup Maker – Popup for opt-ins, lead gen, & more: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-47597 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.
Product
Popup Maker – Popup for opt-ins, lead gen, & more
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Popup Maker – Popup for opt-ins, lead gen, & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Media File Renamer: Rename Files (Manual, Auto & AI): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
Product
Media File Renamer: Rename Files (Manual, Auto & AI)
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update Media File Renamer: Rename Files (Manual, Auto & AI) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Aruba HiSpeed Cache: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44983 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
Product
Aruba HiSpeed Cache
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
Product
Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
Affected
up to 6.4.5
What to do
Affects up to 6.4.5. Update Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted requestCVE-2023-6203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
Product
Events Calendar
Fixed in
6.2.8.1
What to do
Update Events Calendar to 6.2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
Product
SmartCrawl
Fixed in
3.8.3
What to do
Update SmartCrawl to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5714 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5713 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5712 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5711 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5710 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 30, 2023The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/myCVE-2023-6360 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.
Fixed in
3.4.22
What to do
Update the plugin to 3.4.22 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Nov 30, 2023Premium Addons PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
Product
Premium Addons PRO
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email download link: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
Product
Email download link
Affected
up to 3.7
What to do
Affects up to 3.7. Update Email download link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.0.64
What to do
Affects up to 1.0.64. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Zippy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-26533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.
Product
Zippy
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.
Product
Libsyn Publisher Hub
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Booster for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48333 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.
Product
Booster for WooCommerce
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Image Regenerate & Select Crop: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-46820 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0.
Product
Image Regenerate & Select Crop
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4.
Product
Libsyn Publisher Hub
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45066 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
Product
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.13.2
What to do
Affects up to 4.13.2. Update Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email posts to subscribers: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-41735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.
Product
Email posts to subscribers
Affected
up to 6.2
What to do
Affects up to 6.2. Update Email posts to subscribers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Cookies and Content Security Policy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
Product
Cookies and Content Security Policy
Affected
up to 2.15
What to do
Affects up to 2.15. Update Cookies and Content Security Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023EWWW Image Optimizer: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
Product
EWWW Image Optimizer
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update EWWW Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Post Grid Combo – 36+ Gutenberg Blocks: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40211 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.
Product
Post Grid Combo – 36+ Gutenberg Blocks
Affected
up to 2.2.50
What to do
Affects up to 2.2.50. Update Post Grid Combo – 36+ Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Product Stock Manager & Notifier for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37972 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.
Product
Product Stock Manager & Notifier for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Product Stock Manager & Notifier for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Debug Log Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-6136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.
Product
Debug Log Manager
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Debug Log Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tagsCVE-2023-5845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tags
Product
Simple Social Media Share Buttons
Fixed in
5.1.1
What to do
Update Simple Social Media Share Buttons to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2023Cloud Templates & Patterns collection: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.
Product
Cloud Templates & Patterns collection
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Cloud Templates & Patterns collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 23, 2023Email Marketing for WooCommerce by Omnisend: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
Product
Email Marketing for WooCommerce by Omnisend
Affected
up to 1.13.8
What to do
Affects up to 1.13.8. Update Email Marketing for WooCommerce by Omnisend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.CVE-2023-47668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.CVE-2023-40002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.CVE-2023-23978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.
Fixed in
1.0.17
What to do
Update the plugin to 1.0.17 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023UserPro: Unauthorized access of data, modification of data, loss of dataCVE-2023-6007 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.
Product
UserPro
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbitrary email address.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5417 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms category for a given post ID.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5416 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5415 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5411 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post values. Note that the extent of modification is limited due to fixed values passed to the wp_update_post function.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5387 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable the dark mode plugin setting.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5386 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, including administrator posts, and posts not related to the Funnelforms Free plugin. CVE-2023-5990 appears to be a duplicate of this issue.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Funnelforms Free: Unauthorized modification of dataCVE-2023-5385 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of arbitrary posts.
Product
Funnelforms Free
Affected
up to 3.4
What to do
Affects up to 3.4. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023WP EXtra: Unauthorized access to restricted functionalityCVE-2023-5314 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to send emails with arbitrary content to arbitrary locations from the affected site's mail server.
Product
WP EXtra
Affected
up to 6.2
What to do
Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.