Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

4,276 results · page 74 of 86

Jun 9, 2024Booster Plus for WooCommerce: Missing AuthorizationCVE-2023-52232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Product
Booster Plus for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Plus for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Booster Plus for WooCommerce: Missing AuthorizationCVE-2023-52230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.
Product
Booster Plus for WooCommerce
Fixed in
7.1.3
What to do
Update Booster Plus for WooCommerce to 7.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WooCommerce Product Vendors: Missing AuthorizationCVE-2023-51494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.
Product
WooCommerce Product Vendors
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WooCommerce Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Import and export users and customers: Missing AuthorizationCVE-2024-22151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
Product
Import and export users and customers
Affected
up to 1.24.6
What to do
Affects up to 1.24.6. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Icegram: Missing AuthorizationCVE-2024-21748 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.
Product
Icegram
Affected
up to 3.1.21
What to do
Affects up to 3.1.21. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024KiviCare: Missing AuthorizationCVE-2024-35659 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.
Product
KiviCare
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'impoCVE-2024-5324 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2024-35674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.109.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.109
What to do
Affects up to 1.5.109. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Spiffy Calendar: Missing AuthorizationCVE-2024-30528 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
Product
Spiffy Calendar
Affected
up to 4.9.10
What to do
Affects up to 4.9.10. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Move Addons for Elementor: Missing AuthorizationCVE-2024-30525 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9.
Product
Move Addons for Elementor
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Netgsm: Missing AuthorizationCVE-2024-35672 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.19.
Product
Netgsm
Affected
up to 2.9.19
What to do
Affects up to 2.9.19. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024RT Easy Builder – Advanced addons for Elementor: Missing AuthorizationCVE-2024-30484 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RT Easy Builder – Advanced addons for Elementor.This issue affects RT Easy Builder – Advanced addons for Elementor: from n/a through 2.0.
Product
RT Easy Builder – Advanced addons for Elementor
Affected
up to 2.0
What to do
Affects up to 2.0. Update RT Easy Builder – Advanced addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Missing AuthorizationCVE-2023-28494 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.
Product
Contact Form Email
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024CP Multi View Event Calendar: Missing AuthorizationCVE-2023-28492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Functionality Misuse.This issue affects CP Multi View Event Calendar: from n/a through 1.4.10.
Product
CP Multi View Event Calendar
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024CP Contact Form with Paypal: Missing AuthorizationCVE-2023-27460 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34.
Product
CP Contact Form with Paypal
Affected
up to 1.3.34
What to do
Affects up to 1.3.34. Update CP Contact Form with Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Event Espresso 4 Decaf: Missing AuthorizationCVE-2023-27437 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf allows Functionality Misuse.This issue affects Event Espresso 4 Decaf: from n/a through 4.10.44.Decaf.
Product
Event Espresso 4 Decaf
Affected
up to 4.10.44.Decaf
What to do
Affects up to 4.10.44.Decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Calculated Fields Form: Missing AuthorizationCVE-2023-26523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n/a through 1.1.120.
Product
Calculated Fields Form
Affected
up to 1.1.120
What to do
Affects up to 1.1.120. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Search in Place: Missing AuthorizationCVE-2023-26521 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Search in Place allows Functionality Misuse.This issue affects Search in Place: from n/a through 1.0.104.
Product
Search in Place
Affected
up to 1.0.104
What to do
Affects up to 1.0.104. Update Search in Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Fastly: Missing AuthorizationCVE-2024-34803 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
Product
Fastly
Affected
up to 1.2.25
What to do
Affects up to 1.2.25. Update Fastly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 29, 2024AppPresser: Improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functionsCVE-2024-4611 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the 'openssl' php extension is not loaded on the server.
Product
AppPresser
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2024KKProgressbar2 Free: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-4533 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks
Product
KKProgressbar2 Free
Affected
up to 1.1.4.2
What to do
Affects up to 1.1.4.2. Update KKProgressbar2 Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 18, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-3714 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024Flo Forms: Missing AuthorizationCVE-2024-35174 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Flothemes Flo Forms.This issue affects Flo Forms: from n/a through 1.0.42.
Product
Flo Forms
Affected
up to 1.0.42
What to do
Affects up to 1.0.42. Update Flo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024BP Better Messages: Missing AuthorizationCVE-2024-32802 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WordPlus BP Better Messages allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Better Messages: from n/a through 2.4.32.
Product
BP Better Messages
Affected
up to 2.4.32
What to do
Affects up to 2.4.32. Update BP Better Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Chauffeur Taxi Booking System for: Missing AuthorizationCVE-2024-32692 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 6.9.
Product
Chauffeur Taxi Booking System for
Affected
up to 6.9
What to do
Affects up to 6.9. Update Chauffeur Taxi Booking System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Church Admin: Missing AuthorizationCVE-2024-31281 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6.
Product
Church Admin
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Headless CMS: Missing AuthorizationCVE-2023-34186 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3.
Product
Headless CMS
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Headless CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024EventPrime: Missing AuthorizationCVE-2023-33321 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.
Product
EventPrime
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Editorialmag: Missing AuthorizationCVE-2023-32129 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle WP Editorialmag editorialmag.This issue affects Editorialmag: from n/a through 1.1.9.
Product
Editorialmag
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Editorialmag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024My Tickets: Missing AuthorizationCVE-2023-23988 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Joseph C Dolson My Tickets.This issue affects My Tickets: from n/a through 1.9.11.
Product
My Tickets
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Conditional Checkout Fields for WooCommerce: Missing AuthorizationCVE-2022-45070 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3.
Product
Conditional Checkout Fields for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Conditional Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2024SP Project & Document Manager: Is missing validation in its upload functionCVE-2024-3748 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Custom WooCommerce Checkout Fields Editor: Missing AuthorizationCVE-2024-33956 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
Product
Custom WooCommerce Checkout Fields Editor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Google Typography: Missing AuthorizationCVE-2024-33942 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Eric Alli Google Typography.This issue affects Google Typography: from n/a through 1.1.2.
Product
Google Typography
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Google Typography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sliding Widgets: Missing AuthorizationCVE-2024-33938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codename065 Sliding Widgets allows Cross-Site Scripting (XSS).This issue affects Sliding Widgets: from n/a through 1.5.0.
Product
Sliding Widgets
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Sliding Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024AppPresser: Missing AuthorizationCVE-2024-32776 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0.
Product
AppPresser
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2024-32724 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Woo product importer Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1.
Product
Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP Club Manager: Missing AuthorizationCVE-2024-32719 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Club Manager WP Club Manager wp-club-manager.This issue affects WP Club Manager: from n/a through <= 2.2.11.
Product
WP Club Manager
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update WP Club Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SchedulePress: Missing AuthorizationCVE-2024-32717 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through 5.0.8.
Product
SchedulePress
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update SchedulePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Podlove Podcast Publisher: Missing AuthorizationCVE-2024-32712 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.
Product
Podlove Podcast Publisher
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2024-4233 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Vitepos: Missing AuthorizationCVE-2024-33574 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
Product
Vitepos
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024EPROLO Dropshipping: Missing AuthorizationCVE-2024-33573 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1.
Product
EPROLO Dropshipping
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update EPROLO Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024ARForms Form Builder: Missing AuthorizationCVE-2024-31270 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.
Product
ARForms Form Builder
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024AI WP Writer: Missing AuthorizationCVE-2024-30459 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5.
Product
AI WP Writer
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update AI WP Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Happy Addons for Elementor: Missing AuthorizationCVE-2024-24833 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.1.
Product
Happy Addons for Elementor
Affected
up to 3.10.1
What to do
Affects up to 3.10.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Rolo Slider: Missing AuthorizationCVE-2024-1438 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9.
Product
Rolo Slider
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Rolo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-40218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
Product
Advance WordPress Search
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Multi-column Tag Map: Missing AuthorizationCVE-2023-41651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26.
Product
Multi-column Tag Map
Affected
up to 17.0.26
What to do
Affects up to 17.0.26. Update Multi-column Tag Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 7, 2024Tilda Publishing: Missing AuthorizationCVE-2023-31234 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Tilda Publishing.This issue affects Tilda Publishing: from n/a through 0.3.23.
Product
Tilda Publishing
Affected
up to 0.3.23
What to do
Affects up to 0.3.23. Update Tilda Publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.