Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 81 of 126
Jan 2, 2025Bold Timeline Lite: Missing AuthorizationCVE-2023-45110 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Timeline Lite: from n/a through <= 1.1.9.
- Product
- Bold Timeline Lite
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025BetterLinks: Missing AuthorizationCVE-2023-45104 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in WPDeveloper BetterLinks betterlinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through <= 1.6.0.
- Product
- BetterLinks
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Customer Reviews for WooCommerce: Missing AuthorizationCVE-2023-45101 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce customer-reviews-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through <= 5.36.0.
- Product
- Customer Reviews for WooCommerce
- Affected
- up to 5.36.0
- What to do
- Affects up to 5.36.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Job Openings: Missing AuthorizationCVE-2023-45061 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awsm.in WP Job Openings wp-job-openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through <= 3.4.1.
- Product
- WP Job Openings
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update WP Job Openings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Custom Widget area: Missing AuthorizationCVE-2023-45045 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in krozero WP Custom Widget area wp-custom-widget-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Widget area: from n/a through <= 1.2.5.
- Product
- WP Custom Widget area
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Custom Widget area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP User Frontend: Missing AuthorizationCVE-2023-45002 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.
- Product
- WP User Frontend
- Affected
- up to 3.6.8
- What to do
- Affects up to 3.6.8. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Custom Admin Interface: Missing AuthorizationCVE-2023-44988 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP Custom Admin Interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through 7.32.
- Product
- WP Custom Admin Interface
- Affected
- up to 7.32
- What to do
- Affects up to 7.32. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Schema App Structured Data: Missing AuthorizationCVE-2023-44258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vberkel Schema App Structured Data schema-app-structured-data-for-schemaorg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schema App Structured Data: from n/a through <= 1.23.1.
- Product
- Schema App Structured Data
- Affected
- up to 1.23.1
- What to do
- Affects up to 1.23.1. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Agency Toolkit: Missing AuthorizationCVE-2024-56066 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <= 1.0.23.
- Product
- Agency Toolkit
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Agency Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024RepairBuddy: Missing AuthorizationCVE-2024-56061 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through <= 3.8119.
- Product
- RepairBuddy
- Affected
- up to 3.8119
- What to do
- Affects up to 3.8119. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Contact Form, Survey & Form Builder – MightyForms: Missing AuthorizationCVE-2024-56002 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form, Survey & Form Builder – MightyForms: from n/a through <= 1.3.9.
- Product
- Contact Form, Survey & Form Builder – MightyForms
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Contact Form, Survey & Form Builder – MightyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Torod: Missing AuthorizationCVE-2024-55995 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Torod Company for Information Technology Torod torod allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Torod: from n/a through <= 1.7.
- Product
- Torod
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Torod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Paytium: Missing AuthorizationCVE-2024-51667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10.
- Product
- Paytium
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Best Restaurant Menu by PriceListo: Missing AuthorizationCVE-2024-49698 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto.This issue affects Best Restaurant Menu by PriceListo: from n/a through <= 1.4.2.
- Product
- Best Restaurant Menu by PriceListo
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Best Restaurant Menu by PriceListo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024My Wp Brand: Missing AuthorizationCVE-2024-49694 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in imw3 My Wp Brand my-wp-brand.This issue affects My Wp Brand: from n/a through <= 1.1.2.
- Product
- My Wp Brand
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update My Wp Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Smart Manager: Missing AuthorizationCVE-2024-49687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0.
- Product
- Smart Manager
- Affected
- up to 8.45.0
- What to do
- Affects up to 8.45.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Landing Page Cat: Missing AuthorizationCVE-2024-49686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in fatcatapps Landing Page Cat landing-page-cat.This issue affects Landing Page Cat: from n/a through <= 1.7.4.
- Product
- Landing Page Cat
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Smart Shopify Product: Missing AuthorizationCVE-2024-56031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through <= 1.0.2.
- Product
- Smart Shopify Product
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Smart Shopify Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP-CRM System: Missing AuthorizationCVE-2024-55991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.2.9.1.
- Product
- WP-CRM System
- Affected
- up to 3.2.9.1
- What to do
- Affects up to 3.2.9.1. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WooCommerce Subscriptions: Missing AuthorizationCVE-2023-50850 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Woo WooCommerce Subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Subscriptions: from n/a before 5.8.0.
- Product
- WooCommerce Subscriptions
- Fixed in
- 5.8.0
- What to do
- Update WooCommerce Subscriptions to 5.8.0 or newer.
Dec 31, 2024WP Cleanfix: Missing AuthorizationCVE-2023-48775 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gfazioli WP Cleanfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cleanfix: from n/a through 5.6.2.
- Product
- WP Cleanfix
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update WP Cleanfix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024VW Automobile Lite: Missing AuthorizationCVE-2024-56234 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through <= 2.1.
- Product
- VW Automobile Lite
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update VW Automobile Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Royal Elementor Addons: Missing AuthorizationCVE-2024-56227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.
- Product
- Royal Elementor Addons
- Affected
- up to 1.7.1001
- What to do
- Affects up to 1.7.1001. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Premium Addons for Elementor: Missing AuthorizationCVE-2024-56225 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.56.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.10.56
- What to do
- Affects up to 4.10.56. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Widget Options: Missing AuthorizationCVE-2024-56219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.6.1.
- Product
- Widget Options
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Download Manager: Missing AuthorizationCVE-2024-56217 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03.
- Product
- Download Manager
- Affected
- up to 3.3.03
- What to do
- Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Member Directory and Contact Form: Missing AuthorizationCVE-2024-56215 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Member Directory and Contact Form: from n/a through <= 1.7.0.
- Product
- Member Directory and Contact Form
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Member Directory and Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Userpro: Missing AuthorizationCVE-2024-56211 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 24, 2024MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution: Unauthorized accessCVE-2024-12413 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketking_delete_team_member', 'marketkingrejectuser', 'marketking_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthenticated attackers to delete users, update settings, approve users, and more.
- Product
- MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
- Affected
- up to 2.0.00
- What to do
- Affects up to 2.0.00. Update MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 24, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Unauthorized access of dataCVE-2024-12190 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- What to do
- Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 24, 2024Print Invoice & Delivery Notes for WooCommerce: Unauthorized modification of dataCVE-2024-12210 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdn_remove_shoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 24, 2024WC Price History for Omnibus: Unauthorized accessCVE-2024-12617 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and modify history data.
- Product
- WC Price History for Omnibus
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 24, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Unauthorized access of dataCVE-2024-12266 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
- Product
- ELEX WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 21, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows): Unauthorized access of dataCVE-2024-11852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.
- Product
- Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
- Affected
- up to 5.10.12
- What to do
- Affects up to 5.10.12. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 21, 2024WP BASE Booking of Appointments, Services and Events: Unauthorized access of dataCVE-2024-12558 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
- Product
- WP BASE Booking of Appointments, Services and Events
- Affected
- up to 4.9.2
- What to do
- Affects up to 4.9.2. Update WP BASE Booking of Appointments, Services and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2024Maintenance & Coming Soon Redirect Animation: Unauthorized modification of dataCVE-2024-9503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings.
- Product
- Maintenance & Coming Soon Redirect Animation
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 19, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-12331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Filebird plugin.
- Product
- File Manager Pro – Filester
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 19, 2024Download Manager: Unauthorized download of password-protected contentCVE-2024-11768 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.
- Product
- Download Manager
- Affected
- up to 3.3.03
- What to do
- Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024WPLMS: Missing AuthorizationCVE-2024-56048 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Advance Menu Manager: Missing AuthorizationCVE-2024-54381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Menu Manager: from n/a through <= 3.1.1.
- Product
- Advance Menu Manager
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Advance Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56008 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
- Product
- Spreadr Woocommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Order Delivery & Pickup Location Date Time: Missing AuthorizationCVE-2024-55997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through <= 1.1.0.
- Product
- Order Delivery & Pickup Location Date Time
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Order Delivery & Pickup Location Date Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024WP Menu Image: Missing AuthorizationCVE-2024-52485 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image wp-menu-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Menu Image: from n/a through <= 2.2.
- Product
- WP Menu Image
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Menu Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Travel Booking: Unauthorized modification of dataCVE-2024-11926 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_approve_booking', 'save_order_item', and '__userDenyEachInfo' functions in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify posts, delete posts and pages, approve arbitrary orders, insert orders with arbitrary prices, and deny user information.
- Product
- Travel Booking
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Travel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtravelerwp.comwordfence.com
Dec 17, 2024Accept Authorize.NET Payments Using Contact Form 7: Information ExposureCVE-2024-12250 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.
- Product
- Accept Authorize.NET Payments Using Contact Form 7
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 17, 2024Easy Digital Downloads: Improper AuthorizationCVE-2024-9654 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.
- Product
- Easy Digital Downloads
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2024Caldera SMTP Mailer: Missing AuthorizationCVE-2024-56003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Cramer Caldera SMTP Mailer caldera-smtp-mailer.This issue affects Caldera SMTP Mailer: from n/a through <= 1.0.1.
- Product
- Caldera SMTP Mailer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Caldera SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.