Updated 45 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

4,276 results · page 69 of 86

Jul 24, 2024Optimize Images ALT Text (alt tag) & names for SEO using AI: Full Path DisclosureCVE-2024-6571 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Optimize Images ALT Text (alt tag) & names for SEO using AI
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Optimize Images ALT Text (alt tag) & names for SEO using AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2024WP EasyPay – Square for: Unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() functionCVE-2024-5861 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
Product
WP EasyPay – Square for
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update WP EasyPay – Square for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2024Social Auto Poster: Unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ functionCVE-2024-6754 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Insecure Direct Object ReferenceCVE-2024-5977 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 19, 2024PayPlus Payment Gateway: Does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated usersCVE-2024-6205 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
Product
PayPlus Payment Gateway
Fixed in
6.6.9
What to do
Update PayPlus Payment Gateway to 6.6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Get Better Reviews for WooCommerce: Missing AuthorizationCVE-2024-37544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Saleswonder Team: Tobias Get Better Reviews for WooCommerce more-better-reviews-for-woocommerce.This issue affects Get Better Reviews for WooCommerce: from n/a through <= 4.0.6.
Product
Get Better Reviews for WooCommerce
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Get Better Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter: Missing AuthorizationCVE-2024-37202 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter custom-add-to-cart-button-for-woocommerce.This issue affects Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter: from n/a through <= 1.222.17.
Product
Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter
Affected
up to 1.222.17
What to do
Affects up to 1.222.17. Update Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6316 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-37555 is a duplicate of this issue.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Unrestricted Upload of File with Dangerous TypeCVE-2024-37555 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 6, 2024Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2024-37542 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 3, 2024The allows any authenticated user to join a private group due to a missing authorization check on a functionCVE-2024-2231 · WordPress plugins & themes · reported by WPScanMedium 6.5
The allows any authenticated user to join a private group due to a missing authorization check on a function
Fixed in
2.1.1
What to do
Update the plugin to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2024Contact Form 7: Has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosingCVE-2024-4704 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing.
Product
Contact Form 7
Fixed in
5.9.5
What to do
Update Contact Form 7 to 5.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2024kadence-blocks-pro: Does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the databaseCVE-2024-1330 · WordPress plugins & themes · reported by WPScanMedium 4.3
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.
Product
kadence-blocks-pro
Fixed in
2.3.8
What to do
Update kadence-blocks-pro to 2.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2024WishList Member X: Missing AuthorizationCVE-2024-37111 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024EmbedPress: Missing AuthorizationCVE-2023-51375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.8.3.
Product
EmbedPress
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WordPress Form Builder Plugin – Gutenberg Forms: Missing AuthorizationCVE-2022-45803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Builder Plugin – Gutenberg Forms: from n/a through 2.2.8.3.
Product
WordPress Form Builder Plugin – Gutenberg Forms
Affected
up to 2.2.8.3
What to do
Affects up to 2.2.8.3. Update WordPress Form Builder Plugin – Gutenberg Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WP Tools: Missing AuthorizationCVE-2022-43453 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Bill Minozzi WP Tools.This issue affects WP Tools: from n/a through 3.41.
Product
WP Tools
Affected
up to 3.41
What to do
Affects up to 3.41. Update WP Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 20, 2024HTML5 Video Player: Does not sanitize and escape a parameter from a REST route before using it in a SQL statementCVE-2024-5522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
HTML5 Video Player
Fixed in
2.5.27
What to do
Update HTML5 Video Player to 2.5.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2024Slider Revolution: Missing AuthorizationCVE-2024-34444 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0.
Product
Slider Revolution
Fixed in
6.7.0
What to do
Update Slider Revolution to 6.7.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Avada: Missing AuthorizationCVE-2023-39312 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
Product
Avada
Affected
up to 7.11.1
What to do
Affects up to 7.11.1. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JupiterX Core: Missing AuthorizationCVE-2023-38394 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
Product
JupiterX Core
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38393 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Product
Ninja Forms
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024LearnPress: Missing AuthorizationCVE-2023-36516 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
Product
LearnPress
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024LearnPress: Missing AuthorizationCVE-2023-36515 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
Product
LearnPress
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Attorney: Missing AuthorizationCVE-2022-45832 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Hennessey Digital Attorney.This issue affects Attorney: from n/a through 3.
Product
Attorney
Affected
up to 3
What to do
Affects up to 3. Update Attorney to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Fusion Builder: Missing AuthorizationCVE-2023-39310 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
Product
Fusion Builder
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Ship to Multiple Addresses: Missing AuthorizationCVE-2023-37872 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.5.
Product
WooCommerce Ship to Multiple Addresses
Affected
up to 3.8.5
What to do
Affects up to 3.8.5. Update WooCommerce Ship to Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Premium Addons PRO: Missing AuthorizationCVE-2023-37869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
Product
Premium Addons PRO
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Convert Pro: Missing AuthorizationCVE-2023-36684 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.
Product
Convert Pro
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Convert Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Schema Pro: Missing AuthorizationCVE-2023-36683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8.
Product
Schema Pro
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Schema Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Spectra: Missing AuthorizationCVE-2023-36676 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
Product
Spectra
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Premium Starter Templates: Missing AuthorizationCVE-2023-41805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium Starter Templates: from n/a through 3.2.5; Starter Templates: from n/a through 3.2.5.
Product
Premium Starter Templates
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Premium Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Betheme: Missing AuthorizationCVE-2023-39998 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1.
Product
Betheme
Affected
up to 27.1.1
What to do
Affects up to 27.1.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Elements kit Elementor addons: Missing AuthorizationCVE-2023-39993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wpmet Elements kit Elementor addons.This issue affects Elements kit Elementor addons: from n/a through 2.9.0.
Product
Elements kit Elementor addons
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Elements kit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Paid Memberships Pro: Missing AuthorizationCVE-2023-39990 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.
Product
Paid Memberships Pro
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Avada: Missing AuthorizationCVE-2023-39922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
Product
Avada
Affected
up to 7.11.1
What to do
Affects up to 7.11.1. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38386 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Product
Ninja Forms
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-37870 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.1.9.
Product
WooCommerce Warranty Requests
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024AutomateWoo: Missing AuthorizationCVE-2023-36512 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5.
Product
AutomateWoo
Affected
up to 5.7.5
What to do
Affects up to 5.7.5. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Elementor Pro: Missing AuthorizationCVE-2023-35050 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Elementor Elementor Pro.This issue affects Elementor Pro: from n/a through 3.13.0.
Product
Elementor Pro
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Stripe Payment Gateway: Missing AuthorizationCVE-2023-35049 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.4.0.
Product
WooCommerce Stripe Payment Gateway
Affected
up to 7.4.0
What to do
Affects up to 7.4.0. Update WooCommerce Stripe Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Betheme: Missing AuthorizationCVE-2023-47770 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1.
Product
Betheme
Affected
up to 27.1.1
What to do
Affects up to 27.1.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Checkout Manager: Missing AuthorizationCVE-2023-47681 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in QuadLayers WooCommerce Checkout Manager.This issue affects WooCommerce Checkout Manager: from n/a through 7.3.0.
Product
WooCommerce Checkout Manager
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update WooCommerce Checkout Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Themify Ultra: Missing AuthorizationCVE-2023-46148 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Themify Ultra: Missing AuthorizationCVE-2023-46146 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Nexter: Missing AuthorizationCVE-2023-45658 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in POSIMYTH Nexter.This issue affects Nexter: from n/a through 2.0.3.
Product
Nexter
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Nexter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Pre-Publish Checklist: Missing AuthorizationCVE-2023-44151 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1.
Product
Pre-Publish Checklist
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Pre-Publish Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Astra Bulk Edit: Missing AuthorizationCVE-2023-44148 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7.
Product
Astra Bulk Edit
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Astra Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Paid Memberships Pro CCBill Gateway: Missing AuthorizationCVE-2023-40608 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.
Product
Paid Memberships Pro CCBill Gateway
Affected
up to 0.3
What to do
Affects up to 0.3. Update Paid Memberships Pro CCBill Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.