Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,275 results · page 66 of 86

Nov 1, 2024Waitlist Woocommerce ( Back in stock notifier ): Missing AuthorizationCVE-2024-43134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.6.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.6
What to do
Affects up to 2.6. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Robin image optimizer: Missing AuthorizationCVE-2024-43122 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Creative Motion Robin image optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robin image optimizer: from n/a through 1.6.9.
Product
Robin image optimizer
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Robin image optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024TypeSquare Webfonts: Missing AuthorizationCVE-2024-43120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in XSERVER Inc. TypeSquare Webfonts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TypeSquare Webfonts: from n/a through 2.0.7.
Product
TypeSquare Webfonts
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update TypeSquare Webfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Aruba HiSpeed Cache: Missing AuthorizationCVE-2024-43119 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Aruba.It Aruba HiSpeed Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.12.
Product
Aruba HiSpeed Cache
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Hummingbird: Missing AuthorizationCVE-2024-43118 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.
Product
Hummingbird
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Filter & Grids: Missing AuthorizationCVE-2024-39664 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in YMC Filter & Grids allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Filter & Grids: from n/a through 2.8.33.
Product
Filter & Grids
Affected
up to 2.8.33
What to do
Affects up to 2.8.33. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Sign-up Sheets: Missing AuthorizationCVE-2024-39654 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets.This issue affects Sign-up Sheets: from n/a through <= 2.2.12.
Product
Sign-up Sheets
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WooCommerce PDF Vouchers: Missing AuthorizationCVE-2024-39650 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4.
Product
WooCommerce PDF Vouchers
Fixed in
4.9.5
What to do
Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP Social Feed Gallery: Missing AuthorizationCVE-2024-39640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in QuadLayers WP Social Feed Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 4.3.9.
Product
WP Social Feed Gallery
Affected
up to 4.3.9
What to do
Affects up to 4.3.9. Update WP Social Feed Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Youzify: Missing AuthorizationCVE-2024-39635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in KaineLabs Youzify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youzify: from n/a through 1.2.6.
Product
Youzify
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Youzify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Icegram: Missing AuthorizationCVE-2024-39625 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24.
Product
Icegram
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Custom Query Blocks: Missing AuthorizationCVE-2024-38794 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MediaRon LLC Custom Query Blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Custom Query Blocks: from n/a through 5.2.0.
Product
Custom Query Blocks
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Language Translate Widget for WordPress – ConveyThis: Missing AuthorizationCVE-2024-38792 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ConveyThis Translate Team Language Translate Widget for WordPress – ConveyThis allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Language Translate Widget for WordPress – ConveyThis: from n/a through 234.
Product
Language Translate Widget for WordPress – ConveyThis
Affected
up to 234
What to do
Affects up to 234. Update Language Translate Widget for WordPress – ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Arconix FAQ: Missing AuthorizationCVE-2024-38783 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tyche Softwares Arconix FAQ allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix FAQ: from n/a through 1.9.4.
Product
Arconix FAQ
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Titan Anti-spam & Security: Missing AuthorizationCVE-2024-38777 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CreativeMotion Titan Anti-spam & Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Titan Anti-spam & Security: from n/a through 7.3.6.
Product
Titan Anti-spam & Security
Affected
up to 7.3.6
What to do
Affects up to 7.3.6. Update Titan Anti-spam & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024SiteGround Security: Missing AuthorizationCVE-2024-38774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SiteGround SiteGround Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through 1.5.0.
Product
SiteGround Security
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Atarim: Missing AuthorizationCVE-2024-38771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 4.0.
Product
Atarim
Affected
up to 4.0
What to do
Affects up to 4.0. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Arconix Shortcodes: Missing AuthorizationCVE-2024-38769 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tyche Softwares Arconix Shortcodes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix Shortcodes: from n/a through 2.1.11.
Product
Arconix Shortcodes
Affected
up to 2.1.11
What to do
Affects up to 2.1.11. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Wholesale Suite: Missing AuthorizationCVE-2024-38745 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wholesale Suite: from n/a through 2.1.12.
Product
Wholesale Suite
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update Wholesale Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Plum: Spin Wheel & Email Pop-up: Missing AuthorizationCVE-2024-38744 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
Product
Plum: Spin Wheel & Email Pop-up
Affected
up to 2.0
What to do
Affects up to 2.0. Update Plum: Spin Wheel & Email Pop-up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Packlink PRO shipping module: Missing AuthorizationCVE-2024-38740 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Packlink Shipping S.L. Packlink PRO shipping module allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Packlink PRO shipping module: from n/a through 3.4.6.
Product
Packlink PRO shipping module
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Packlink PRO shipping module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024ReDi Restaurant Reservation: Missing AuthorizationCVE-2024-38737 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReDi Restaurant Reservation: from n/a through 24.0422.
Product
ReDi Restaurant Reservation
Affected
up to 24.0422
What to do
Affects up to 24.0422. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Meks Video Importer: Missing AuthorizationCVE-2024-38733 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Meks Meks Video Importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meks Video Importer: from n/a through 1.0.12.
Product
Meks Video Importer
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Meks Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Seraphinite Post .DOCX Source: Missing AuthorizationCVE-2024-38727 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.
Product
Seraphinite Post .DOCX Source
Affected
up to 2.16.9
What to do
Affects up to 2.16.9. Update Seraphinite Post .DOCX Source to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Product Designer: Missing AuthorizationCVE-2024-38726 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Designer: from n/a through 1.0.33.
Product
Product Designer
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024EazyDocs: Missing AuthorizationCVE-2024-38721 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in spider-themes EazyDocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through 2.5.0.
Product
EazyDocs
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Auto Featured Image (Auto Post Thumbnail): Missing AuthorizationCVE-2024-38719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.1.2.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP Fast Total Search: Missing AuthorizationCVE-2024-38714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.68.232.
Product
WP Fast Total Search
Affected
up to 1.68.232
What to do
Affects up to 1.68.232. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024EmbedPress: Missing AuthorizationCVE-2024-38707 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in WPDeveloper EmbedPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmbedPress: from n/a through 4.0.4.
Product
EmbedPress
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Product Delivery Date for WooCommerce – Lite: Missing AuthorizationCVE-2024-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.
Product
Product Delivery Date for WooCommerce – Lite
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP GoToWebinar: Missing AuthorizationCVE-2024-38695 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.
Product
WP GoToWebinar
Affected
up to 15.6
What to do
Affects up to 15.6. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-38690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3.
Product
iPanorama 360 WordPress Virtual Tour Builder
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024User Activity Log Pro: Missing AuthorizationCVE-2024-37929 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4.
Product
User Activity Log Pro
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update User Activity Log Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP Accessibility Helper (WAH): Missing AuthorizationCVE-2024-37926 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.9.
Product
WP Accessibility Helper (WAH)
Affected
up to 0.6.2.9
What to do
Affects up to 0.6.2.9. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Chained Quiz: Missing AuthorizationCVE-2024-37921 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kiboko Labs Chained Quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chained Quiz: from n/a through 1.3.2.8.
Product
Chained Quiz
Affected
up to 1.3.2.8
What to do
Affects up to 1.3.2.8. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Spectra: Missing AuthorizationCVE-2024-37517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7.
Product
Spectra
Affected
up to 2.13.7
What to do
Affects up to 2.13.7. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37516 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.2.
Product
Featured Image from URL
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Charitable: Missing AuthorizationCVE-2024-37510 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.
Product
Charitable
Affected
up to 1.8.1.7
What to do
Affects up to 1.8.1.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Charitable: Missing AuthorizationCVE-2024-37506 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.
Product
Charitable
Affected
up to 1.8.1.7
What to do
Affects up to 1.8.1.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Business One Page: Missing AuthorizationCVE-2024-37505 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rara Themes Business One Page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business One Page: from n/a through 1.2.9.
Product
Business One Page
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Business One Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37483 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
Product
The Post Grid
Affected
up to 7.7.4
What to do
Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
Product
The Post Grid
Affected
up to 7.7.4
What to do
Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37481 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
Product
The Post Grid
Affected
up to 7.7.4
What to do
Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack Content Converter: Missing AuthorizationCVE-2024-37477 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Automattic Newspack Content Converter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Content Converter: from n/a through 0.1.5.
Product
Newspack Content Converter
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update Newspack Content Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack Newsletters: Missing AuthorizationCVE-2024-37475 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newspack Newsletters: from n/a through 2.13.2.
Product
Newspack Newsletters
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Woffice Core: Missing AuthorizationCVE-2024-37470 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.
Product
Woffice Core
Affected
up to 5.4.8
What to do
Affects up to 5.4.8. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newsmatic: Missing AuthorizationCVE-2024-37468 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in blazethemes Newsmatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newsmatic: from n/a through 1.3.1.
Product
Newsmatic
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Newsmatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024CRM Perks Forms: Missing AuthorizationCVE-2024-37463 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.
Product
CRM Perks Forms
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Noptin: Missing AuthorizationCVE-2024-37456 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Noptin Newsletter Noptin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Noptin: from n/a through 3.4.2.
Product
Noptin
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024ProfileGrid: Missing AuthorizationCVE-2024-37453 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 5.8.7.
Product
ProfileGrid
Affected
up to 5.8.7
What to do
Affects up to 5.8.7. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.