Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 80 of 126
Jan 2, 2025Dragfy Addons for Elementor: Missing AuthorizationCVE-2023-47661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dragfy Dragfy Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dragfy Addons for Elementor: from n/a through 1.0.2.
- Product
- Dragfy Addons for Elementor
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Dragfy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025EazyDocs: Missing AuthorizationCVE-2023-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through <= 2.3.5.
- Product
- EazyDocs
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025BadgeOS: Missing AuthorizationCVE-2023-47647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LearningTimes BadgeOS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BadgeOS: from n/a through 3.7.1.6.
- Product
- BadgeOS
- Affected
- up to 3.7.1.6
- What to do
- Affects up to 3.7.1.6. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Visitors Traffic Real Time Statistics: Missing AuthorizationCVE-2023-47557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/a through <= 7.2.
- Product
- Visitors Traffic Real Time Statistics
- Affected
- up to 7.2
- What to do
- Affects up to 7.2. Update Visitors Traffic Real Time Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Auto Tag Creator: Missing AuthorizationCVE-2023-47523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecreate Infotech Auto Tag Creator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Tag Creator: from n/a through 1.0.2.
- Product
- Auto Tag Creator
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Auto Tag Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Seers: Missing AuthorizationCVE-2023-47515 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Seers Seers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seers: from n/a through 8.1.1.
- Product
- Seers
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update Seers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025CoCart – Headless ecommerce: Missing AuthorizationCVE-2023-47241 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2.
- Product
- CoCart – Headless ecommerce
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update CoCart – Headless ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Short URL: Missing AuthorizationCVE-2023-47225 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through <= 1.6.8.
- Product
- Short URL
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Travel: Missing AuthorizationCVE-2023-47224 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 7.8.0.
- Product
- WP Travel
- Affected
- up to 7.8.0
- What to do
- Affects up to 7.8.0. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Simple Job Board: Missing AuthorizationCVE-2023-47188 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5.
- Product
- Simple Job Board
- Affected
- up to 2.10.5
- What to do
- Affects up to 2.10.5. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Animated Rotating Words: Missing AuthorizationCVE-2023-47187 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Rotating Words: from n/a through <= 5.4.
- Product
- Animated Rotating Words
- Affected
- up to 5.4
- What to do
- Affects up to 5.4. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-47183 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1.
- Product
- GiveWP
- Affected
- up to 2.33.1
- What to do
- Affects up to 2.33.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Finale Lite: Missing AuthorizationCVE-2023-47180 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Finale Lite: from n/a through 2.16.0.
- Product
- Finale Lite
- Affected
- up to 2.16.0
- What to do
- Affects up to 2.16.0. Update Finale Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WooODT Lite: Missing AuthorizationCVE-2023-47179 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through <= 2.4.6.
- Product
- WooODT Lite
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update WooODT Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WordPress CTA: Missing AuthorizationCVE-2023-46644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8.
- Product
- WordPress CTA
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update WordPress CTA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025kk Star Ratings: Missing AuthorizationCVE-2023-46639 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.5.
- Product
- kk Star Ratings
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update kk Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Generate Dummy Posts: Missing AuthorizationCVE-2023-46637 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saurav Sharma Generate Dummy Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Generate Dummy Posts: from n/a through 1.0.0.
- Product
- Generate Dummy Posts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Generate Dummy Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025YITH WooCommerce Product Add-Ons: Missing AuthorizationCVE-2023-46635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.2.0.
- Product
- YITH WooCommerce Product Add-Ons
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Glossary: Missing AuthorizationCVE-2023-46633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in TCBarrett Glossary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Glossary: from n/a through 3.1.2.
- Product
- Glossary
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025My Shortcodes: Missing AuthorizationCVE-2023-46632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in David Cramer My Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Shortcodes: from n/a through 2.3.
- Product
- My Shortcodes
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update My Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Product Recommendation Quiz for eCommerce: Missing AuthorizationCVE-2023-46631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RevenueHunt Product Recommendation Quiz for eCommerce product-recommendation-quiz-for-ecommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Recommendation Quiz for eCommerce: from n/a through <= 2.1.2.
- Product
- Product Recommendation Quiz for eCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Recommendation Quiz for eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Word Count: Missing AuthorizationCVE-2023-46628 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedLettuce Plugins WP Word Count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Word Count: from n/a through 3.2.4.
- Product
- WP Word Count
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update WP Word Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Draw Attention: Missing AuthorizationCVE-2023-46616 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NSquared Draw Attention allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Draw Attention: from n/a through 2.0.15.
- Product
- Draw Attention
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Draw Attention to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Mediabay: Missing AuthorizationCVE-2023-46612 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codedraft Mediabay mediabay-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mediabay: from n/a through <= 1.6.
- Product
- Mediabay
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Mediabay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Quill Forms: Missing AuthorizationCVE-2023-46610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mohamed Magdy Quill Forms quillforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quill Forms: from n/a through <= 3.3.0.
- Product
- Quill Forms
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Quill Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025FeedFocal: Missing AuthorizationCVE-2023-46609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FeedFocal FeedFocal feedfocal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FeedFocal: from n/a through <= 1.2.2.
- Product
- FeedFocal
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update FeedFocal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025DoLogin Security: Missing AuthorizationCVE-2023-46608 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through <= 3.7.1.
- Product
- DoLogin Security
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update DoLogin Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP iCal Availability: Missing AuthorizationCVE-2023-46607 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP iCal Availability WP iCal Availability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP iCal Availability: from n/a through 1.0.3.
- Product
- WP iCal Availability
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP iCal Availability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025AtomChat: Missing AuthorizationCVE-2023-46606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Team AtomChat AtomChat atomchat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AtomChat: from n/a through <= 1.1.4.
- Product
- AtomChat
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Convertful – Your Ultimate On-Site Conversion Tool: Missing AuthorizationCVE-2023-46605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ruslan Suhar Convertful – Your Ultimate On-Site Conversion Tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Convertful – Your Ultimate On-Site Conversion Tool: from n/a through 2.5.
- Product
- Convertful – Your Ultimate On-Site Conversion Tool
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Convertful – Your Ultimate On-Site Conversion Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025wpDiscuz: Missing AuthorizationCVE-2023-46309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.10.
- Product
- wpDiscuz
- Affected
- up to 7.6.10
- What to do
- Affects up to 7.6.10. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025MW WP Form: Missing AuthorizationCVE-2023-46206 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Webの相談所 MW WP Form mw-wp-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MW WP Form: from n/a through <= 4.4.5.
- Product
- MW WP Form
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Just Custom Fields: Missing AuthorizationCVE-2023-46203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2.
- Product
- Just Custom Fields
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Just Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2023-46196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 4.97.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 4.97
- What to do
- Affects up to 4.97. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Headline Analyzer: Missing AuthorizationCVE-2023-46195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headline Analyzer: from n/a through <= 1.3.1.
- Product
- Headline Analyzer
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Headline Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Freesoul Deactivate Plugins – Plugin manager and cleanup: Missing AuthorizationCVE-2023-46188 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins – Plugin manager and cleanup: from n/a through 2.1.3.
- Product
- Freesoul Deactivate Plugins – Plugin manager and cleanup
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Freesoul Deactivate Plugins – Plugin manager and cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-46083 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.27.
- Product
- Kali Forms
- Affected
- up to 2.3.27
- What to do
- Affects up to 2.3.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Broken Link Checker | Finder: Missing AuthorizationCVE-2023-46082 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder broken-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through <= 2.4.2.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025ApplyOnline – Application Form Builder and Manager: Missing AuthorizationCVE-2023-46080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a through 2.5.3.
- Product
- ApplyOnline – Application Form Builder and Manager
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update ApplyOnline – Application Form Builder and Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Ashe Extra: Missing AuthorizationCVE-2023-46079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Royal Ashe Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe Extra: from n/a through 1.2.9.
- Product
- Ashe Extra
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Ashe Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025DX Delete Attached Media: Missing AuthorizationCVE-2023-46073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev DX Delete Attached Media dx-delete-attached-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DX Delete Attached Media: from n/a through <= 2.0.5.1.
- Product
- DX Delete Attached Media
- Affected
- up to 2.0.5.1
- What to do
- Affects up to 2.0.5.1. Update DX Delete Attached Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025RumbleTalk Live Group Chat: Missing AuthorizationCVE-2023-45828 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.
- Product
- RumbleTalk Live Group Chat
- Affected
- up to 6.2.5
- What to do
- Affects up to 6.2.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Poll Maker: Missing AuthorizationCVE-2023-45766 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.7.1.
- Product
- Poll Maker
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP ERP: Missing AuthorizationCVE-2023-45765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.12.6.
- Product
- WP ERP
- Affected
- up to 1.12.6
- What to do
- Affects up to 1.12.6. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025wpDiscuz: Missing AuthorizationCVE-2023-45760 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.3.
- Product
- wpDiscuz
- Affected
- up to 7.6.3
- What to do
- Affects up to 7.6.3. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Appointment Hour Booking: Missing AuthorizationCVE-2023-45649 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople Appointment Hour Booking appointment-hour-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Hour Booking: from n/a through <= 1.4.23.
- Product
- Appointment Hour Booking
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update Appointment Hour Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WordPress Backup & Migration: Missing AuthorizationCVE-2023-45636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through <= 1.4.1.
- Product
- WordPress Backup & Migration
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2023-45631 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
- Product
- Responsive Image Gallery, Gallery Album
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-45275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.28.
- Product
- Kali Forms
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WowStore: Missing AuthorizationCVE-2023-45271 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 2.7.8.
- Product
- WowStore
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update WowStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.