Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 67 of 86
Nov 1, 2024Defender Security: Missing AuthorizationCVE-2024-37444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through <= 4.7.1.
- Product
- Defender Security
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Job Manager - Resume Manager: Missing AuthorizationCVE-2024-37443 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
- Product
- WP Job Manager - Resume Manager
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Church Admin: Missing AuthorizationCVE-2024-37440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.
- Product
- Church Admin
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Uncanny Toolkit Pro for LearnDash: Missing AuthorizationCVE-2024-37439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0
- Product
- Uncanny Toolkit Pro for LearnDash
- What to do
- Update Uncanny Toolkit Pro for LearnDash to the newest version.
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-37427 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.
- Product
- Timetics
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Missing AuthorizationCVE-2024-37425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024e2pdf: Missing AuthorizationCVE-2024-37415 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
- Product
- e2pdf
- Affected
- up to 1.20.27
- What to do
- Affects up to 1.20.27. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Progress Planner: Missing AuthorizationCVE-2024-37411 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through <= 0.9.1.
- Product
- Progress Planner
- Affected
- up to 0.9.1
- What to do
- Affects up to 0.9.1. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.
- Product
- Featured Image from URL
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masterstudy Elementor Widgets: Missing AuthorizationCVE-2024-37269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ElementsKit Elementor addons Lite: Missing AuthorizationCVE-2024-37255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.1.4.
- Product
- ElementsKit Elementor addons Lite
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024File Manager: Missing AuthorizationCVE-2024-37254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.
- Product
- File Manager
- Affected
- up to 7.2.7
- What to do
- Affects up to 7.2.7. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37250 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
- Product
- Advanced Custom Fields PRO
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37249 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
- Product
- Advanced Custom Fields PRO
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Hercules Core: Missing AuthorizationCVE-2024-37232 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Hercules Design Hercules Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hercules Core: from n/a through 6.5.
- Product
- Hercules Core
- Affected
- up to 6.5
- What to do
- Affects up to 6.5. Update Hercules Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Kanban Boards for: Missing AuthorizationCVE-2024-37226 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
- Product
- Kanban Boards for
- Affected
- up to 2.5.21
- What to do
- Affects up to 2.5.21. Update Kanban Boards for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Optinly: Missing AuthorizationCVE-2024-37220 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OptinlyHQ Optinly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optinly: from n/a through 1.0.18.
- Product
- Optinly
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Optinly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Page Builder Sandwich – Front-End Page Builder: Missing AuthorizationCVE-2024-37218 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
- Product
- Page Builder Sandwich – Front-End Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ali2Woo Lite: Missing AuthorizationCVE-2024-37214 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
- Product
- Ali2Woo Lite
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ali2Woo Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Demo Awesome: Missing AuthorizationCVE-2024-37207 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2.
- Product
- Demo Awesome
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024PropertyHive: Missing AuthorizationCVE-2024-37204 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9.
- Product
- PropertyHive
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Laybuy Payment Extension for WooCommerce: Missing AuthorizationCVE-2024-37203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.
- Product
- Laybuy Payment Extension for WooCommerce
- Affected
- up to 5.3.9
- What to do
- Affects up to 5.3.9. Update Laybuy Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Woocommerce Customers Order History: Missing AuthorizationCVE-2024-37201 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2.
- Product
- Woocommerce Customers Order History
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update Woocommerce Customers Order History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ibtana: Missing AuthorizationCVE-2024-37123 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3.
- Product
- Ibtana
- Affected
- up to 1.2.3.3
- What to do
- Affects up to 1.2.3.3. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Uncanny Automator Pro: Missing AuthorizationCVE-2024-37119 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator Pro: from n/a through 5.3.0.0.
- Product
- Uncanny Automator Pro
- Affected
- up to 5.3.0.0
- What to do
- Affects up to 5.3.0.0. Update Uncanny Automator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Missing AuthorizationCVE-2024-37106 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Popup box: Missing AuthorizationCVE-2024-37096 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Popup Box Team Popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup box: from n/a through 4.5.1.
- Product
- Popup box
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-37095 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.7.3.
- Product
- Envira Photo Gallery
- Affected
- up to 1.8.7.3
- What to do
- Affects up to 1.8.7.3. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024MasterStudy LMS: Missing AuthorizationCVE-2024-37094 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
- Product
- MasterStudy LMS
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024User Toolkit: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3.
- Product
- User Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update User Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50454 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Multi Step Form: Missing AuthorizationCVE-2024-50428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.
- Product
- Multi Step Form
- Affected
- up to 1.7.21
- What to do
- Affects up to 1.7.21. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
- Product
- Templately
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
- Product
- Templately
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Breeze: Missing AuthorizationCVE-2024-50422 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
- Product
- Breeze
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2024-50421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 3.8.6.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50456 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50455 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024AidWP: Missing AuthorizationCVE-2024-50459 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AidWP: from n/a through <= 3.2.3.
- Product
- AidWP
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update AidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024PegaPoll: Missing AuthorizationCVE-2024-50490 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2.
- Product
- PegaPoll
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update PegaPoll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024GRÜN spendino Spendenformular: Missing AuthorizationCVE-2024-50476 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.
- Product
- GRÜN spendino Spendenformular
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update GRÜN spendino Spendenformular to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Signup Page: Missing AuthorizationCVE-2024-50475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.
- Product
- Signup Page
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Signup Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Token Login: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50488 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.
- Product
- Token Login
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Token Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Realty Workstation: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50489 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through <= 1.0.45.
- Product
- Realty Workstation
- Affected
- up to 1.0.45
- What to do
- Affects up to 1.0.45. Update Realty Workstation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024MaanStore API: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50487 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects MaanStore API: from n/a through <= 1.0.1.
- Product
- MaanStore API
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update MaanStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Acnoo Flutter API: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through <= 1.0.5.
- Product
- Acnoo Flutter API
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Acnoo Flutter API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Stacks Mobile App Builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
- Product
- Stacks Mobile App Builder
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024Schema & Structured Data for WP & AMP: Missing AuthorizationCVE-2024-49683 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through <= 1.3.5.
- Product
- Schema & Structured Data for WP & AMP
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 20243D Work In Progress: Missing AuthorizationCVE-2024-49657 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through <= 1.0.3.
- Product
- 3D Work In Progress
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update 3D Work In Progress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2024iBryl Switch User: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49675 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii iBryl Switch User ibryl-switch-user allows Authentication Bypass.This issue affects iBryl Switch User: from n/a through <= 1.0.1.
- Product
- iBryl Switch User
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update iBryl Switch User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.