Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

525new WordPress flaws this week

391,883entries in the database

4,276 results · page 78 of 86

Mar 25, 2024MainWP Wordfence Extension: Missing AuthorizationCVE-2023-22699 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.This issue affects MainWP Wordfence Extension: from n/a through 4.0.7.
Product
MainWP Wordfence Extension
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update MainWP Wordfence Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024ShareThis Dashboard for Google Analytics: Missing AuthorizationCVE-2022-45851 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through 3.1.4.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45352 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45351 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45349 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024SEO Plugin by Squirrly SEO: Missing AuthorizationCVE-2022-44626 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.1.20
What to do
Affects up to 12.1.20. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-38057 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
Product
Advance WordPress Search
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024RealHomes: Missing AuthorizationCVE-2023-37886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2.
Product
RealHomes
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update RealHomes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024RealHomes: Missing AuthorizationCVE-2023-37885 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2.
Product
RealHomes
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update RealHomes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Viral News: Missing AuthorizationCVE-2023-33923 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral: from n/a through 1.8.0; HashOne: from n/a through 1.3.0.
Product
Viral News
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Viral News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Educenter: Missing AuthorizationCVE-2023-30480 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5.
Product
Educenter
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Educenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024Element Pack Elementor Addons: Missing AuthorizationCVE-2024-24840 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.4.11.
Product
Element Pack Elementor Addons
Affected
up to 5.4.11
What to do
Affects up to 5.4.11. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024BEAR: Missing AuthorizationCVE-2024-24835 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.
Product
BEAR
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024EventPrime: Missing AuthorizationCVE-2024-24832 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Product
EventPrime
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Download Media: Missing AuthorizationCVE-2024-27190 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2.
Product
Download Media
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Download Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Word Replacer Pro: Missing AuthorizationCVE-2023-52229 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0.
Product
Word Replacer Pro
Affected
up to 1.0
What to do
Affects up to 1.0. Update Word Replacer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Olive One Click Demo Import: Missing AuthorizationCVE-2024-2702 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
Product
Olive One Click Demo Import
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Olive One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Simple Ajax Chat: Does not prevent visitors from using malicious NamesCVE-2024-1983 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.
Product
Simple Ajax Chat
Fixed in
20240223
What to do
Update Simple Ajax Chat to 20240223 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Fancy Product Designer: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0365 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.
Product
Fancy Product Designer
Fixed in
6.1.5
What to do
Update Fancy Product Designer to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 15, 2024Sirv: Missing AuthorizationCVE-2023-50898 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2.
Product
Sirv
Affected
up to 7.1.2
What to do
Affects up to 7.1.2. Update Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Cryptocurrency Widgets – Price Ticker & Coins List: Missing AuthorizationCVE-2024-27953 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.8.
Product
Cryptocurrency Widgets – Price Ticker & Coins List
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update Cryptocurrency Widgets – Price Ticker & Coins List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing caCVE-2024-2172 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Comments Extra Fields For Post,Pages and CPT: Missing AuthorizationCVE-2024-0829 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is due to missing or incorrect capability checks on several ajax actions. This makes it possible for authenticated attackers, with subscriber access or higher, to invoke those actions. As a result, they may modify comment form fields and update plugin settings.
Product
Comments Extra Fields For Post,Pages and CPT
Affected
up to 5.0
What to do
Affects up to 5.0. Update Comments Extra Fields For Post,Pages and CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2024404 Solution: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-1068 · WordPress plugins & themes · reported by WPScanHigh 7.2
The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins.
Product
404 Solution
Fixed in
2.35.8
What to do
Update 404 Solution to 2.35.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 4, 2024Auto Refresh Single Page: PHP Object InjectionCVE-2024-1731 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arsp_options post meta option. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Auto Refresh Single Page
Affected
up to 1.1
What to do
Affects up to 1.1. Update Auto Refresh Single Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2024Sirv: Missing AuthorizationCVE-2024-27950 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0.
Product
Sirv
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 29, 2024Perfmatters: Missing AuthorizationCVE-2023-47874 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.
Product
Perfmatters
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Customer Reviews for WooCommerce: Missing AuthorizationCVE-2023-51692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.1
What to do
Affects up to 5.38.1. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 27, 2024Thank You Page Customizer for WooCommerce – Increase Your Sales: Missing authorization eCVE-2024-1686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.
Product
Thank You Page Customizer for WooCommerce – Increase Your Sales
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Thank You Page Customizer for WooCommerce – Increase Your Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Smart Manager
Fixed in
8.28.0
What to do
Update Smart Manager to 8.28.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 10, 2024GiveWP – Donation Plugin and Fundraising Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51415 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 2, 2024Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on theCVE-2024-1047 · WordPress plugins & themes · reported by WordfenceMedium 5.3
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
Affected
up to 2.10.28
What to do
Affects up to 2.10.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2024WIP Custom Login: Missing AuthorizationCVE-2022-42884 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7.
Product
WIP Custom Login
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WIP Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2022-41790 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.
Product
WP Time Slots Booking Form
Affected
up to 1.1.76
What to do
Affects up to 1.1.76. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024WP Job Portal – A Complete Job Board: Missing AuthorizationCVE-2022-41786 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.
Product
WP Job Portal – A Complete Job Board
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update WP Job Portal – A Complete Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024URL Shortener by MyThemeShop: Missing AuthorizationCVE-2023-23896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.
Product
URL Shortener by MyThemeShop
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update URL Shortener by MyThemeShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Ultimate Addons for Beaver Builder – Lite: Missing AuthorizationCVE-2023-23882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.5.
Product
Ultimate Addons for Beaver Builder – Lite
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Ultimate Addons for Beaver Builder – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Traffic Manager: Missing AuthorizationCVE-2022-41695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.
Product
Traffic Manager
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Traffic Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Image Zoom: Missing AuthorizationCVE-2022-41619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.
Product
Image Zoom
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update Image Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Advanced Local Pickup for WooCommerce: Missing AuthorizationCVE-2022-40702 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Cart2Cart: Magento to WooCommerce Migration: Missing AuthorizationCVE-2023-34379 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0.
Product
Cart2Cart: Magento to WooCommerce Migration
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Cart2Cart: Magento to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Advanced Dynamic Pricing for WooCommerce: Missing AuthorizationCVE-2022-40203 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.1.5.
Product
Advanced Dynamic Pricing for WooCommerce
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Advanced Dynamic Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Sales Report Email for WooCommerce: Missing AuthorizationCVE-2022-38141 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8.
Product
Sales Report Email for WooCommerce
Affected
up to 2.8
What to do
Affects up to 2.8. Update Sales Report Email for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024HREFLANG Tags Lite: Missing AuthorizationCVE-2022-36418 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.
Product
HREFLANG Tags Lite
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update HREFLANG Tags Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Track The Click: Does not properly sanitize query parameters to the stats REST endpoint before using them in a database queryCVE-2023-5041 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
Product
Track The Click
Fixed in
0.3.12
What to do
Update Track The Click to 0.3.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Voting Record: Is missing sanitisationCVE-2023-7084 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks
Product
Voting Record
Affected
up to 2.0
What to do
Affects up to 2.0. Update Voting Record to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 16, 2024Royal Elementor Addons and Templates: Does not ensure that users accessing posts via an AJAX action (and REST endpointCVE-2023-5922 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content
Product
Royal Elementor Addons and Templates
Fixed in
1.3.81
What to do
Update Royal Elementor Addons and Templates to 1.3.81 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
WordPress Database Administrator
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Contact Form by WD: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2655 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Contact Form by WD
Affected
up to 1.13.23
What to do
Affects up to 1.13.23. Update Contact Form by WD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.