Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 65 of 86
Nov 1, 2024Blockbooster: Missing AuthorizationCVE-2024-43979 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.
- Product
- Blockbooster
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Blockbooster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ReviveNews: Missing AuthorizationCVE-2024-43974 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.
- Product
- ReviveNews
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update ReviveNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024GetPaid: Missing AuthorizationCVE-2024-43973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.
- Product
- GetPaid
- Affected
- up to 2.8.11
- What to do
- Affects up to 2.8.11. Update GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024LWS Affiliation: Missing AuthorizationCVE-2024-43962 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.
- Product
- LWS Affiliation
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update LWS Affiliation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Memberpress: Missing AuthorizationCVE-2024-43956 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34.
- Product
- Memberpress
- Affected
- up to 1.11.34
- What to do
- Affects up to 1.11.34. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Crowdfunding: Missing AuthorizationCVE-2024-43937 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024The Plus Addons for Elementor Page Builder Lite: Missing AuthorizationCVE-2024-43932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JobSearch: Missing AuthorizationCVE-2024-43929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a through 2.5.4.
- Product
- JobSearch
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JobSearch: Missing AuthorizationCVE-2024-43928 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4.
- Product
- JobSearch
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-43925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14.
- Product
- Envira Photo Gallery
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-43923 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.
- Product
- Timetics
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JoomSport: Missing AuthorizationCVE-2024-43355 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0.
- Product
- JoomSport
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update JoomSport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Order Tracking: Missing AuthorizationCVE-2024-43343 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Order Tracking: from n/a through 3.3.12.
- Product
- Order Tracking
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Hello Agency: Missing AuthorizationCVE-2024-43341 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5.
- Product
- Hello Agency
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Hello Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Photo Engine: Missing AuthorizationCVE-2024-43332 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.
- Product
- Photo Engine
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update Photo Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ReviewX: Missing AuthorizationCVE-2024-43323 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.28.
- Product
- ReviewX
- Affected
- up to 1.6.28
- What to do
- Affects up to 1.6.28. Update ReviewX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Asset CleanUp: Page Speed Booster: Missing AuthorizationCVE-2024-43314 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.3.9.3
- What to do
- Affects up to 1.3.9.3. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WPC Frequently Bought Together for WooCommerce: Missing AuthorizationCVE-2024-43312 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.
- Product
- WPC Frequently Bought Together for WooCommerce
- Affected
- up to 7.1.9
- What to do
- Affects up to 7.1.9. Update WPC Frequently Bought Together for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2024-43310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through 3.4.9.
- Product
- Print Barcode Labels for your WooCommerce products/orders
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Fonts: Missing AuthorizationCVE-2024-43302 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fonts Plugin Fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fonts: from n/a through 3.7.7.
- Product
- Fonts
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Clone: Missing AuthorizationCVE-2024-43298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
- Product
- Clone
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Clone: Missing AuthorizationCVE-2024-43297 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
- Product
- Clone
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Flash & HTML5 Video: Missing AuthorizationCVE-2024-43296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.
- Product
- Flash & HTML5 Video
- Affected
- up to 2.5.30
- What to do
- Affects up to 2.5.30. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2024-43293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.3.1.
- Product
- Recipe Card Blocks for Gutenberg & Elementor
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Atarim: Missing AuthorizationCVE-2024-43290 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 4.0.1.
- Product
- Atarim
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Presto Player: Missing AuthorizationCVE-2024-43285 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Presto Made, Inc Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Presto Player: from n/a through 3.0.2.
- Product
- Presto Player
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024UsersWP: Missing AuthorizationCVE-2024-43277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.
- Product
- UsersWP
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2024-43274 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Icegram Collect: Missing AuthorizationCVE-2024-43273 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect plugin: from n/a through 1.3.14.
- Product
- Icegram Collect
- Affected
- up to 1.3.14
- What to do
- Affects up to 1.3.14. Update Icegram Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Backup and Restore: Missing AuthorizationCVE-2024-43270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPBackItUp Backup and Restore WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Backup and Restore WordPress: from n/a through 1.50.
- Product
- Backup and Restore
- Affected
- up to 1.50
- What to do
- Affects up to 1.50. Update Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Clearfy Cache: Missing AuthorizationCVE-2024-43260 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clearfy Cache: from n/a through 2.2.4.
- Product
- Clearfy Cache
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Clearfy Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Smart Online Order for Clover: Missing AuthorizationCVE-2024-43254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.
- Product
- Smart Online Order for Clover
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Smart Online Order for Clover: Missing AuthorizationCVE-2024-43253 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.
- Product
- Smart Online Order for Clover
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2024-43235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.
- Product
- Meta Box – WordPress Custom Fields Framework
- Affected
- up to 5.9.10
- What to do
- Affects up to 5.9.10. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Search Analytics: Missing AuthorizationCVE-2024-43229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cornel Raiu WP Search Analytics search-analytics.This issue affects WP Search Analytics: from n/a through <= 1.4.9.
- Product
- WP Search Analytics
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update WP Search Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024EventPrime: Missing AuthorizationCVE-2024-43223 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2.
- Product
- EventPrime
- Affected
- up to 4.0.3.2
- What to do
- Affects up to 4.0.3.2. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Persian WooCommerce: Missing AuthorizationCVE-2024-43219 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ووکامرس فارسی Persian WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Persian WooCommerce: from n/a through 7.1.6.
- Product
- Persian WooCommerce
- Affected
- up to 7.1.6
- What to do
- Affects up to 7.1.6. Update Persian WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Social Slider Feed: Missing AuthorizationCVE-2024-43215 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in creativemotion Social Slider Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Slider Feed: from n/a through 2.2.2.
- Product
- Social Slider Feed
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Social Slider Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WpTravelly: Missing AuthorizationCVE-2024-43212 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in MagePeople Team WpTravelly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through 1.7.7.
- Product
- WpTravelly
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Bitly: Missing AuthorizationCVE-2024-43209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Bitly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bitly: from n/a through 2.7.2.
- Product
- Bitly
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Bitly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Send Emails with Mandrill: Missing AuthorizationCVE-2024-43208 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Matt Miller Send Emails with Mandrill send-emails-with-mandrill allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Send Emails with Mandrill: from n/a through <= 1.4.1.
- Product
- Send Emails with Mandrill
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Send Emails with Mandrill to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Easy Digital Downloads: Missing AuthorizationCVE-2024-43162 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
- Product
- Easy Digital Downloads
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masteriyo - LMS: Missing AuthorizationCVE-2024-43159 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.6.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.6
- What to do
- Affects up to 1.11.6. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masteriyo - LMS: Missing AuthorizationCVE-2024-43158 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.4
- What to do
- Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024FormCraft: Missing AuthorizationCVE-2024-43157 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10.
- Product
- FormCraft
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Cron Manager – debug & control: Missing AuthorizationCVE-2024-43154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.
- Product
- Advanced Cron Manager – debug & control
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024AMP for WP: Missing AuthorizationCVE-2024-43146 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AMP for WP: from n/a through 1.0.96.1.
- Product
- AMP for WP
- Affected
- up to 1.0.96.1
- What to do
- Affects up to 1.0.96.1. Update AMP for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Registrations for the Events Calendar: Missing AuthorizationCVE-2024-43143 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Roundup WP Registrations for the Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registrations for the Events Calendar: from n/a through 2.12.1.
- Product
- Registrations for the Events Calendar
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Registrations for the Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Tutor LMS: Missing AuthorizationCVE-2024-43142 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.
- Product
- Tutor LMS
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-43136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.1.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.