Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

4,276 results · page 70 of 86

Jun 19, 2024All-in-One WP Migration Box Extension: Missing AuthorizationCVE-2023-40004 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue affects All-in-One WP Migration Box Extension: from n/a through 1.53; All-in-One WP Migration OneDrive Extension: from n/a through 1.66; All-in-One WP Migration Dropbox Extension: from n/a through 3.75; All-in-One WP Migration Google Drive Extension: from n/a through 2.79.
Product
All-in-One WP Migration Box Extension
Affected
up to 1.53
What to do
Affects up to 1.53. Update All-in-One WP Migration Box Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48761 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48760 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48759 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Jetpack: Missing AuthorizationCVE-2023-47788 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
Product
Jetpack
Fixed in
12.7
What to do
Update Jetpack to 12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Thrive Theme Builder: Missing AuthorizationCVE-2023-47783 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0.
Product
Thrive Theme Builder
Fixed in
3.24.0
What to do
Update Thrive Theme Builder to 3.24.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Essential Grid: Missing AuthorizationCVE-2023-47771 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in ThemePunch OHG Essential Grid.This issue affects Essential Grid: from n/a through 3.0.18.
Product
Essential Grid
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update Essential Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024ProjectHuddle Client Site: Missing AuthorizationCVE-2023-51376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34.
Product
ProjectHuddle Client Site
Affected
up to 1.0.34
What to do
Affects up to 1.0.34. Update ProjectHuddle Client Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Ninja Tables: Missing AuthorizationCVE-2024-23504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.
Product
Ninja Tables
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Ship to Multiple Addresses: Missing AuthorizationCVE-2023-51497 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.
Product
WooCommerce Ship to Multiple Addresses
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update WooCommerce Ship to Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-51496 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
Product
WooCommerce Warranty Requests
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-51495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
Product
WooCommerce Warranty Requests
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Everest Forms: Missing AuthorizationCVE-2023-51377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3.
Product
Everest Forms
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024WooCommerce Easy Duplicate Product: Missing AuthorizationCVE-2023-51523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7.
Product
WooCommerce Easy Duplicate Product
Affected
up to 0.3.0.7
What to do
Affects up to 0.3.0.7. Update WooCommerce Easy Duplicate Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Business Directory: Missing AuthorizationCVE-2023-51516 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Business Directory Team Business Directory Plugin.This issue affects Business Directory Plugin: from n/a through 6.3.9.
Product
Business Directory
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-51507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
Product
Quiz And Survey Master
Affected
up to 8.1.16
What to do
Affects up to 8.1.16. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2023-37394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0.
Product
WP Dummy Content Generator
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Sublanguage: Missing AuthorizationCVE-2023-36695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.
Product
Sublanguage
Affected
up to 2.9
What to do
Affects up to 2.9. Update Sublanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Kingkong Board: Missing AuthorizationCVE-2023-36694 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
Product
Kingkong Board
Affected
up to 2.1.0.2
What to do
Affects up to 2.1.0.2. Update Kingkong Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024BBS e-Popup: Missing AuthorizationCVE-2023-36504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
Product
BBS e-Popup
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update BBS e-Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Fat Rat Collect: Missing AuthorizationCVE-2023-35045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fat Rat Fat Rat Collect.This issue affects Fat Rat Collect: from n/a through 2.6.7.
Product
Fat Rat Collect
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Fat Rat Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024SendPress Newsletters: Missing AuthorizationCVE-2023-35040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6.
Product
SendPress Newsletters
Affected
up to 1.23.11.6
What to do
Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024SKU Label Changer For WooCommerce: Missing AuthorizationCVE-2023-29174 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0.
Product
SKU Label Changer For WooCommerce
Affected
up to 3.0
What to do
Affects up to 3.0. Update SKU Label Changer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Search & Replace: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-4145 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network).
Product
Search & Replace
Fixed in
3.2.2
What to do
Update Search & Replace to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2024Web Directory Free: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-3552 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
Product
Web Directory Free
Fixed in
1.7.0
What to do
Update Web Directory Free to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2024weForms: Missing AuthorizationCVE-2023-51524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
Product
weForms
Affected
up to 1.6.18
What to do
Affects up to 1.6.18. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Piotnet Forms: Missing AuthorizationCVE-2023-51413 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.29.
Product
Piotnet Forms
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Consensu.Io: Missing AuthorizationCVE-2023-48280 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Consensu.IO Consensu.Io.This issue affects Consensu.Io: from n/a through 1.0.1.
Product
Consensu.Io
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Consensu.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024wpMandrill: Missing AuthorizationCVE-2023-47828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.
Product
wpMandrill
Affected
up to 1.33
What to do
Affects up to 1.33. Update wpMandrill to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024WP GPX Map: Missing AuthorizationCVE-2023-44234 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bastianon Massimo WP GPX Map.This issue affects WP GPX Map: from n/a through 1.7.08.
Product
WP GPX Map
Affected
up to 1.7.08
What to do
Affects up to 1.7.08. Update WP GPX Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Pricing Deals for WooCommerce: Missing AuthorizationCVE-2023-41240 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vark Pricing Deals for WooCommerce.This issue affects Pricing Deals for WooCommerce: from n/a through 2.0.3.2.
Product
Pricing Deals for WooCommerce
Affected
up to 2.0.3.2
What to do
Affects up to 2.0.3.2. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Sticky Social Media Icons: Missing AuthorizationCVE-2023-40672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1.
Product
Sticky Social Media Icons
Affected
up to 2.1
What to do
Affects up to 2.1. Update Sticky Social Media Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Simple Org Chart: Missing AuthorizationCVE-2023-40603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4.
Product
Simple Org Chart
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Simple Org Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Highcompress Image Compressor: Missing AuthorizationCVE-2023-40209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0.
Product
Highcompress Image Compressor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update Highcompress Image Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024WP Clone Menu: Missing AuthorizationCVE-2023-38395 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1.
Product
WP Clone Menu
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Clone Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Buy Me a Coffee: Missing AuthorizationCVE-2023-25030 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Buy Me a Coffee.This issue affects Buy Me a Coffee: from n/a through 3.7.
Product
Buy Me a Coffee
Affected
up to 3.7
What to do
Affects up to 3.7. Update Buy Me a Coffee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-52177 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.3.
Product
Integrate Google Drive
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024ProfileGrid: Missing AuthorizationCVE-2023-52117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through 5.6.6.
Product
ProfileGrid
Affected
up to 5.6.6
What to do
Affects up to 5.6.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Quotes for WooCommerce: Missing AuthorizationCVE-2023-51680 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in TechnoVama Quotes for WooCommerce.This issue affects Quotes for WooCommerce: from n/a through 2.0.1.
Product
Quotes for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Quotes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024BulkGate SMS Plugin for WooCommerce: Missing AuthorizationCVE-2023-51679 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BulkGate BulkGate SMS Plugin for WooCommerce.This issue affects BulkGate SMS Plugin for WooCommerce: from n/a through 3.0.2.
Product
BulkGate SMS Plugin for WooCommerce
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update BulkGate SMS Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024FunnelKit Checkout: Missing AuthorizationCVE-2023-51671 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
Product
FunnelKit Checkout
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update FunnelKit Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024FunnelKit Checkout: Missing AuthorizationCVE-2023-51670 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
Product
FunnelKit Checkout
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update FunnelKit Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Awesome Support: Missing AuthorizationCVE-2023-51537 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5.
Product
Awesome Support
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Simple Staff List: Missing AuthorizationCVE-2023-51526 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brett Shumaker Simple Staff List.This issue affects Simple Staff List: from n/a through 2.2.4.
Product
Simple Staff List
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Simple Staff List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Import and export users and customers: Missing AuthorizationCVE-2024-34815 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.5.
Product
Import and export users and customers
Affected
up to 1.26.5
What to do
Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Tagembed: Missing AuthorizationCVE-2024-34804 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.8.
Product
Tagembed
Affected
up to 5.8
What to do
Affects up to 5.8. Update Tagembed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024BookingPress: Missing AuthorizationCVE-2024-34799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82.
Product
BookingPress
Affected
up to 1.0.82
What to do
Affects up to 1.0.82. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Fastly: Missing AuthorizationCVE-2024-34768 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
Product
Fastly
Affected
up to 1.2.25
What to do
Affects up to 1.2.25. Update Fastly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Builder for WooCommerce reviews shortcodes – ReviewShort: Missing AuthorizationCVE-2024-34763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.5.
Product
Builder for WooCommerce reviews shortcodes – ReviewShort
Affected
up to 1.01.5
What to do
Affects up to 1.01.5. Update Builder for WooCommerce reviews shortcodes – ReviewShort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024WP Fundraising Donation and Crowdfunding Platform: Missing AuthorizationCVE-2024-34758 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4.
Product
WP Fundraising Donation and Crowdfunding Platform
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update WP Fundraising Donation and Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.