Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 78 of 126
Jan 16, 2025WP Meetup: Missing AuthorizationCVE-2025-23916 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nuanced Media WP Meetup wp-meetup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meetup: from n/a through <= 2.3.0.
- Product
- WP Meetup
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Meetup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Contact Form 7 Anti Spambot: Missing AuthorizationCVE-2025-23862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 Anti Spambot: from n/a through <= 1.0.1.
- Product
- Contact Form 7 Anti Spambot
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Contact Form 7 Anti Spambot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP Service Payment Form With Authorize.net: Cross-Site Request Forgery (CSRF)CVE-2025-23804 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through <= 2.6.0.
- Product
- WP Service Payment Form With Authorize.net
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025AI Responsive Gallery Album: Missing AuthorizationCVE-2025-23785 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.
- Product
- AI Responsive Gallery Album
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025User Sync ActiveCampaign: Missing AuthorizationCVE-2025-23778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Pravin Durugkar User Sync ActiveCampaign registered-user-sync-activecampaign allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Sync ActiveCampaign: from n/a through <= 1.3.2.
- Product
- User Sync ActiveCampaign
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update User Sync ActiveCampaign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Cache Sniper for Nginx: Missing AuthorizationCVE-2025-23776 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through <= 1.0.4.2.
- Product
- Cache Sniper for Nginx
- Affected
- up to 1.0.4.2
- What to do
- Affects up to 1.0.4.2. Update Cache Sniper for Nginx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Copy Move Posts: Missing AuthorizationCVE-2025-23764 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ujjavaljani Copy Move Posts copy-move-posts.This issue affects Copy Move Posts: from n/a through <= 1.6.
- Product
- Copy Move Posts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Copy Move Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Woo Tuner: Missing AuthorizationCVE-2025-23761 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2.
- Product
- Woo Tuner
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update Woo Tuner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Rename Author Slug: Cross-Site Request Forgery (CSRF)CVE-2025-23640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan Rename Author Slug rename-author-slug allows Stored XSS.This issue affects Rename Author Slug: from n/a through <= 1.2.0.
- Product
- Rename Author Slug
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Rename Author Slug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Loginplus: Missing AuthorizationCVE-2025-23514 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sanjay Prasad Loginplus loginplus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Loginplus: from n/a through <= 1.2.
- Product
- Loginplus
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025SendGrid for: Missing AuthorizationCVE-2025-23423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SendGrid for WordPress: from n/a through <= 1.4.
- Product
- SendGrid for
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update SendGrid for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Passwords Manager: Unauthorized modification of dataCVE-2024-12614 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and 'post_new_pass' AJAX actions in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and add passwords.
- Product
- Passwords Manager
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Passwords Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2025Multi Step Form: Unauthorized limited file uploadCVE-2024-12427 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.
- Product
- Multi Step Form
- Affected
- up to 1.7.23
- What to do
- Affects up to 1.7.23. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2025Button Block: Missing AuthorizationCVE-2025-22787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
- Product
- Button Block
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Button Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025WP News Sliders: Missing AuthorizationCVE-2025-22779 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP News Sliders: from n/a through <= 1.0.
- Product
- WP News Sliders
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP News Sliders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025WpTravelly: Missing AuthorizationCVE-2025-22737 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through <= 1.8.5.
- Product
- WpTravelly
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025VOD Infomaniak: Missing AuthorizationCVE-2025-22729 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through <= 1.5.9.
- Product
- VOD Infomaniak
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Poll Maker: Missing AuthorizationCVE-2024-56295 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 5.5.6.
- Product
- Poll Maker
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025NitroPack: Unauthorized arbitrary transient updateCVE-2024-11851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
- Product
- NitroPack
- Affected
- up to 1.17.0
- What to do
- Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 15, 2025NitroPack: Unauthorized modification of dataCVE-2024-11848 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a fixed value of '1' which can activate certain options (e.g., enable user registration) or modify certain options in a way that leads to a denial of service condition.
- Product
- NitroPack
- Affected
- up to 1.17.0
- What to do
- Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 14, 2025W3 Total Cache: Unauthorized access of dataCVE-2024-12365 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.
- Product
- W3 Total Cache
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 14, 2025W3 Total Cache: Unauthorized modification of dataCVE-2024-12006 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and deactivate plugin extensions.
- Product
- W3 Total Cache
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 13, 2025Post SMTP: Missing AuthorizationCVE-2025-22800 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 2.9.11.
- Product
- Post SMTP
- Affected
- up to 2.9.11
- What to do
- Affects up to 2.9.11. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025KNR Author List Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja KNR Author List Widget knr-author-list-widget allows Reflected XSS.This issue affects KNR Author List Widget: from n/a through <= 3.1.1.
- Product
- KNR Author List Widget
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update KNR Author List Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 10, 2025Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups: Unauthorized accessCVE-2024-12204 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.
- Product
- Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 10, 2025Essential WP Real Estate: Unauthorized accessCVE-2024-13318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
- Product
- Essential WP Real Estate
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2025Author Avatars List/Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22804 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through <= 2.1.23.
- Product
- Author Avatars List/Block
- Affected
- up to 2.1.23
- What to do
- Affects up to 2.1.23. Update Author Avatars List/Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Title Experiments Free: Missing AuthorizationCVE-2025-22561 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in kbowson Title Experiments Free wp-experiments-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through <= 9.0.4.
- Product
- Title Experiments Free
- Affected
- up to 9.0.4
- What to do
- Affects up to 9.0.4. Update Title Experiments Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025MIMO Woocommerce Order Tracking: Unauthorized modification of dataCVE-2024-5769 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add, update, and delete shipper tracking settings.
- Product
- MIMO Woocommerce Order Tracking
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update MIMO Woocommerce Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2025Newsletter2Go: Unauthorized modification of dataCVE-2024-12618 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset styles.
- Product
- Newsletter2Go
- Affected
- up to 4.0.14
- What to do
- Affects up to 4.0.14. Update Newsletter2Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2025Bitly's: Unauthorized modification of dataCVE-2024-12616 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and retrieve plugin settings.
- Product
- Bitly's
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update Bitly's to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2025linkID: Unauthorized access of dataCVE-2024-12542 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
- Product
- linkID
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update linkID to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2025GS Insever Portfolio: Unauthorized modification of dataCVE-2024-12249 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.
- Product
- GS Insever Portfolio
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update GS Insever Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2025Shopping Cart & eCommerce Store: Unauthorized modification of dataCVE-2024-12712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook function in all versions up to, and including, 5.7.8. This makes it possible for unauthenticated attackers to modify order statuses.
- Product
- Shopping Cart & eCommerce Store
- Affected
- up to 5.7.8
- What to do
- Affects up to 5.7.8. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2025AdForest: Unauthorized modification of dataCVE-2024-12855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete posts, attachments and deactivate a license.
- Product
- AdForest
- Affected
- up to 5.1.7
- What to do
- Affects up to 5.1.7. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 7, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification and retrieval of dataCVE-2024-11916 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Allada T-shirt Designer for Woocommerce: Missing AuthorizationCVE-2025-22363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through <= 1.1.
- Product
- Allada T-shirt Designer for Woocommerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allada T-shirt Designer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Social Media Share Buttons | MashShare: Missing AuthorizationCVE-2025-22319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DearHive Social Media Share Buttons | MashShare.This issue affects Social Media Share Buttons | MashShare: from n/a through 4.0.47.
- Product
- Social Media Share Buttons | MashShare
- Affected
- up to 4.0.47
- What to do
- Affects up to 4.0.47. Update Social Media Share Buttons | MashShare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hide Category by User Role for WooCommerce: Missing AuthorizationCVE-2024-56272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through <= 2.1.1.
- Product
- Hide Category by User Role for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Hide Category by User Role for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
- Product
- WP SecureSubmit
- Affected
- up to 1.5.20
- What to do
- Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22592 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Saoshyant Page Builder: Missing AuthorizationCVE-2025-22560 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through <= 3.8.
- Product
- Saoshyant Page Builder
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Saoshyant Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ST Gallery WP: Missing AuthorizationCVE-2025-22543 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through <= 1.0.8.
- Product
- ST Gallery WP
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update ST Gallery WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Delete Post Copies: Missing AuthorizationCVE-2025-22541 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in etruel WP Delete Post Copies etruel-del-post-copies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delete Post Copies: from n/a through <= 5.5.
- Product
- WP Delete Post Copies
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Delete Post Copies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Slides & Presentations: Missing AuthorizationCVE-2025-22534 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ella Van Durpe Slides & Presentations slide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slides & Presentations: from n/a through <= 0.0.39.
- Product
- Slides & Presentations
- Affected
- up to 0.0.39
- What to do
- Affects up to 0.0.39. Update Slides & Presentations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Help Scout: Missing AuthorizationCVE-2025-22512 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Help Scout: from n/a through <= 6.5.6.
- Product
- Help Scout
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update Help Scout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025RSVP and Event Management: Unauthorized accessCVE-2024-12711 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.
- Product
- RSVP and Event Management
- Affected
- up to 2.7.13
- What to do
- Affects up to 2.7.13. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Jupiter X Core: Unauthorized access of dataCVE-2024-12316 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates.
- Product
- Jupiter X Core
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Jupiter X Core: Unauthorized accessCVE-2024-12033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries
- Product
- Jupiter X Core
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.