Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 66 of 94
Dec 29, 2023Block IPs for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2023-51358 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms.This issue affects Block IPs for Gravity Forms: from n/a through 1.0.1.
- Product
- Block IPs for Gravity Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Block IPs for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Appointment & Event Booking Calendar Plugin – Webba Booking: Cross-Site Request Forgery (CSRF)CVE-2023-51354 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.
- Product
- Appointment & Event Booking Calendar Plugin – Webba Booking
- Affected
- up to 4.5.33
- What to do
- Affects up to 4.5.33. Update Appointment & Event Booking Calendar Plugin – Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023New User Approve: Cross-Site Request Forgery (CSRF)CVE-2023-50902 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1.
- Product
- New User Approve
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023MStore API: Cross-Site Request Forgery (CSRF)CVE-2023-50878 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1.
- Product
- MStore API
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Ultimate Addons for WPBakery Page Builder: Cross-Site Request Forgery (CSRF)CVE-2023-51402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.17.
- Product
- Ultimate Addons for WPBakery Page Builder
- Affected
- up to 3.19.17
- What to do
- Affects up to 3.19.17. Update Ultimate Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Add Any Extension to Pages: Cross-Site Request Forgery (CSRF)CVE-2023-50873 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4.
- Product
- Add Any Extension to Pages
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Add Any Extension to Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Cross-Site Request Forgery (CSRF)CVE-2023-50858 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.
- Product
- Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
- Affected
- up to 4.34
- What to do
- Affects up to 4.34. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 26, 2023WP Sessions Time Monitoring Full Automatic: Does not sanitize the request URL or query parameters before using them in an SQL queryCVE-2023-5203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
- Product
- WP Sessions Time Monitoring Full Automatic
- Fixed in
- 1.0.9
- What to do
- Update WP Sessions Time Monitoring Full Automatic to 1.0.9 or newer.
Dec 21, 2023Dashicons + Custom Post Types: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-22674 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2.
- Product
- Dashicons + Custom Post Types
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Dashicons + Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Advanced Category Template: Cross-Site Request Forgery (CSRF)CVE-2023-50835 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0.1.
- Product
- Advanced Category Template
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Advanced Category Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Ocean Extra: Cross-Site Request Forgery (CSRF)CVE-2023-49164 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2.
- Product
- Ocean Extra
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Participants Database: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-48751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
- Product
- Participants Database
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WP EXtra: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-46212 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.
- Product
- WP EXtra
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023LiveChat – WP live chat plugin for: Cross-Site Request Forgery (CSRF)CVE-2023-49821 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15.
- Product
- LiveChat – WP live chat plugin for
- Affected
- up to 4.5.15
- What to do
- Affects up to 4.5.15. Update LiveChat – WP live chat plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023CSprite: Cross-Site Request Forgery (CSRF)CVE-2023-49763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creatomatic Ltd CSprite.This issue affects CSprite: from n/a through 1.1.
- Product
- CSprite
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CSprite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Product Enquiry for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49761 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a through 3.0.
- Product
- Product Enquiry for WooCommerce
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Product Enquiry for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WPsoonOnlinePage: Cross-Site Request Forgery (CSRF)CVE-2023-49760 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Giannopoulos Kostas WPsoonOnlinePage.This issue affects WPsoonOnlinePage: from n/a through 1.9.
- Product
- WPsoonOnlinePage
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update WPsoonOnlinePage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WooDiscuz – WooCommerce Comments: Cross-Site Request Forgery (CSRF)CVE-2023-49759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.3.0.
- Product
- WooDiscuz – WooCommerce Comments
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023teachPress: Cross-Site Request Forgery (CSRF)CVE-2023-49163 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5.
- Product
- teachPress
- Affected
- up to 9.0.5
- What to do
- Affects up to 9.0.5. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Button Generator – easily Button Builder: Cross-Site Request Forgery (CSRF)CVE-2023-49155 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.
- Product
- Button Generator – easily Button Builder
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Add to Cart Text Changer and Customize Button, Add Custom Icon: Cross-Site Request Forgery (CSRF)CVE-2023-49153 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.
- Product
- Add to Cart Text Changer and Customize Button, Add Custom Icon
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Add to Cart Text Changer and Customize Button, Add Custom Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: Cross-Site Request Forgery (CSRF)CVE-2023-49148 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5.
- Product
- Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023MkRapel Regiones y Ciudades de Chile para WC: Cross-Site Request Forgery (CSRF)CVE-2023-48781 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.
- Product
- MkRapel Regiones y Ciudades de Chile para WC
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update MkRapel Regiones y Ciudades de Chile para WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Product Size Chart For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-48778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5.
- Product
- Product Size Chart For WooCommerce
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Product Size Chart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WooCommerce Login Redirect: Cross-Site Request Forgery (CSRF)CVE-2023-48773 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
- Product
- WooCommerce Login Redirect
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WooCommerce Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Prevent Landscape Rotation: Cross-Site Request Forgery (CSRF)CVE-2023-48772 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
- Product
- Prevent Landscape Rotation
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Prevent Landscape Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Cross-Site Request Forgery (CSRF)CVE-2023-48769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.
- Product
- Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Quantity Plus Minus Button for WooCommerce by CodeAstrology: Cross-Site Request Forgery (CSRF)CVE-2023-48768 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9.
- Product
- Quantity Plus Minus Button for WooCommerce by CodeAstrology
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Quantity Plus Minus Button for WooCommerce by CodeAstrology to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted requestCVE-2023-6203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
- Product
- Events Calendar
- Fixed in
- 6.2.8.1
- What to do
- Update Events Calendar to 6.2.8.1 or newer.
Dec 18, 2023Slider: Does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requestCVE-2023-6077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
- Product
- Slider
- Fixed in
- 3.5.12
- What to do
- Update Slider to 3.5.12 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5886 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5882 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023SVGator – Add Animated SVG Easily: Cross-Site Request Forgery (CSRF)CVE-2023-48766 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4.
- Product
- SVGator – Add Animated SVG Easily
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update SVGator – Add Animated SVG Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023JetElements For Elementor: Cross-Site Request Forgery (CSRF)CVE-2023-48762 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
- Product
- JetElements For Elementor
- Affected
- up to 2.6.13
- What to do
- Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: Cross-Site Request Forgery (CSRF)CVE-2023-46617 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.
- Product
- AdFoxly – Ad Manager, AdSense Ads & Ads.Txt
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update AdFoxly – Ad Manager, AdSense Ads & Ads.Txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023teachPress: Cross-Site Request Forgery (CSRF)CVE-2023-48755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.
- Product
- teachPress
- Affected
- up to 9.0.4
- What to do
- Affects up to 9.0.4. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Disable User Login: Cross-Site Request Forgery (CSRF)CVE-2023-47806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.
- Product
- Disable User Login
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Canada Post Shipping Method: Cross-Site Request Forgery (CSRF)CVE-2023-47789 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
- Product
- Canada Post Shipping Method
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update Canada Post Shipping Method to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WooCommerce Bookings: Cross-Site Request Forgery (CSRF)CVE-2023-47787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
- Product
- WooCommerce Bookings
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update WooCommerce Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Cross-Site Request Forgery (CSRF)CVE-2023-33214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
- Product
- Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023PayTR Taksit Tablosu – WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49853 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu – WooCommerce.This issue affects PayTR Taksit Tablosu – WooCommerce: from n/a through 1.3.1.
- Product
- PayTR Taksit Tablosu – WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PayTR Taksit Tablosu – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WPPerformanceTester: Cross-Site Request Forgery (CSRF)CVE-2023-49844 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kevin Ohashi WPPerformanceTester.This issue affects WPPerformanceTester: from n/a through 2.0.0.
- Product
- WPPerformanceTester
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update WPPerformanceTester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023First Order Discount Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49843 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in QuanticEdge First Order Discount Woocommerce.This issue affects First Order Discount Woocommerce: from n/a through 1.21.
- Product
- First Order Discount Woocommerce
- Affected
- up to 1.21
- What to do
- Affects up to 1.21. Update First Order Discount Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Multi Currency For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49840 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through 1.5.5.
- Product
- Multi Currency For WooCommerce
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Multi Currency For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023GiveWP – Donation Plugin and Fundraising Platform: Server-Side Request Forgery (SSRF)CVE-2022-40312 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 2.25.1
- What to do
- Affects up to 2.25.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Custom Post Type Page Template: Cross-Site Request Forgery (CSRF)CVE-2023-50372 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1.
- Product
- Custom Post Type Page Template
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom Post Type Page Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Menu Bar Cart Icon For WooCommerce By Binary Carpenter: Cross-Site Request Forgery (CSRF)CVE-2023-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3.
- Product
- Menu Bar Cart Icon For WooCommerce By Binary Carpenter
- Affected
- up to 1.49.3
- What to do
- Affects up to 1.49.3. Update Menu Bar Cart Icon For WooCommerce By Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Caddy – Smart Side Cart for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for WooCommerce: from n/a through 1.9.7.
- Product
- Caddy – Smart Side Cart for WooCommerce
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update Caddy – Smart Side Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 17, 2023FOX – Currency Switcher Professional for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49834 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 FOX – Currency Switcher Professional for WooCommerce.This issue affects FOX – Currency Switcher Professional for WooCommerce: from n/a through 1.4.1.4.
- Product
- FOX – Currency Switcher Professional for WooCommerce
- Affected
- up to 1.4.1.4
- What to do
- Affects up to 1.4.1.4. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 17, 2023Product Catalog Feed by PixelYourSite: Cross-Site Request Forgery (CSRF)CVE-2023-49824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite Product Catalog Feed by PixelYourSite.This issue affects Product Catalog Feed by PixelYourSite: from n/a through 2.1.1.
- Product
- Product Catalog Feed by PixelYourSite
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.