Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,269 results · page 82 of 126
Dec 16, 2024Caldera SMTP Mailer: Missing AuthorizationCVE-2024-56003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Cramer Caldera SMTP Mailer caldera-smtp-mailer.This issue affects Caldera SMTP Mailer: from n/a through <= 1.0.1.
- Product
- Caldera SMTP Mailer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Caldera SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024XML Multilanguage Sitemap Generator: Missing AuthorizationCVE-2024-55999 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilanguage Sitemap Generator: from n/a through <= 2.0.6.
- Product
- XML Multilanguage Sitemap Generator
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update XML Multilanguage Sitemap Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP-NERD Toolkit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-54279 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP-NERD Toolkit: from n/a through <= 1.1.
- Product
- WP-NERD Toolkit
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP-NERD Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
- Product
- Spreadr Woocommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Leader: Missing AuthorizationCVE-2024-56007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in leader codes Leader leader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leader: from n/a through <= 2.6.1.
- Product
- Leader
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Leader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Easy Site Importer: Missing AuthorizationCVE-2024-56004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Site Importer: from n/a through <= 1.0.1.
- Product
- Easy Site Importer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Site Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Ksher: Missing AuthorizationCVE-2024-56001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through <= 1.1.1.
- Product
- Ksher
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Ksher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Popup Surveys & Polls for WordPress (Mare.io): Missing AuthorizationCVE-2024-55998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress (Mare.io): from n/a through <= 1.36.
- Product
- Popup Surveys & Polls for WordPress (Mare.io)
- Affected
- up to 1.36
- What to do
- Affects up to 1.36. Update Popup Surveys & Polls for WordPress (Mare.io) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
- Product
- Dreamfox Media Payment gateway per Product for Woocommerce
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024畅言评论系统: Missing AuthorizationCVE-2024-55994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sohu 畅言评论系统 changyan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 畅言评论系统: from n/a through <= 2.0.5.
- Product
- 畅言评论系统
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update 畅言评论系统 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Job Board Manager: Missing AuthorizationCVE-2024-55993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WooCommerce Basic Ordernumbers: Missing AuthorizationCVE-2024-55992 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Basic Ordernumbers: from n/a through <= 1.4.4.
- Product
- WooCommerce Basic Ordernumbers
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WooCommerce Basic Ordernumbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024PixProof: Missing AuthorizationCVE-2024-54417 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.
- Product
- PixProof
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update PixProof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Arabic Webfonts: Missing AuthorizationCVE-2024-54402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arabic Webfonts: from n/a through <= 1.4.6.
- Product
- Arabic Webfonts
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Arabic Webfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2024-54384 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anh Tran Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through <= 2.8.3.
- Product
- Falcon – WordPress Optimizations & Tweaks
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Minterpress: Missing AuthorizationCVE-2024-54379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Quietly Insights: Missing AuthorizationCVE-2024-54378 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through <= 1.2.2.
- Product
- Quietly Insights
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Quietly Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Zita Site Builder: Missing AuthorizationCVE-2024-54369 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.
- Product
- Zita Site Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Zita Site Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Banner System: Missing AuthorizationCVE-2024-54359 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Saul Morales Pacheco Banner System banner-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Banner System: from n/a through <= 1.0.0.
- Product
- Banner System
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Banner System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Termin-Kalender: Missing AuthorizationCVE-2024-54354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in beat.k Termin-Kalender termin-kalender allows Stored XSS.This issue affects Termin-Kalender: from n/a through <= 0.99.47.
- Product
- Termin-Kalender
- Affected
- up to 0.99.47
- What to do
- Affects up to 0.99.47. Update Termin-Kalender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized accessCVE-2024-11715 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized access of dataCVE-2024-11712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to download other users resumes.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 13, 2024GEO my: Missing AuthorizationCVE-2024-54326 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through <= 4.5.0.4.
- Product
- GEO my
- Affected
- up to 4.5.0.4
- What to do
- Affects up to 4.5.0.4. Update GEO my to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024New User Approve: Missing AuthorizationCVE-2024-54323 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 2.6.2.
- Product
- New User Approve
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mark New Posts: Missing AuthorizationCVE-2024-54311 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in i.lychkov Mark New Posts mark-new-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark New Posts: from n/a through <= 7.5.1.
- Product
- Mark New Posts
- Affected
- up to 7.5.1
- What to do
- Affects up to 7.5.1. Update Mark New Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Gou Manage My Account Menu: Missing AuthorizationCVE-2024-54310 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu gou-wc-account-tabs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through <= 1.0.1.8.
- Product
- Gou Manage My Account Menu
- Affected
- up to 1.0.1.8
- What to do
- Affects up to 1.0.1.8. Update Gou Manage My Account Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Car Dealer: Missing AuthorizationCVE-2024-54298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through <= 4.46.
- Product
- Car Dealer
- Affected
- up to 4.46
- What to do
- Affects up to 4.46. Update Car Dealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Awesome Support: Missing AuthorizationCVE-2024-54289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.3.1.
- Product
- Awesome Support
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024News Ticker for Elementor: Missing AuthorizationCVE-2024-54278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.
- Product
- News Ticker for Elementor
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update News Ticker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WPCargo Track & Trace: Missing AuthorizationCVE-2024-54271 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024SiteOrigin Widgets Bundle: Missing AuthorizationCVE-2024-54268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.64.0
- What to do
- Affects up to 1.64.0. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CM Answers: Missing AuthorizationCVE-2024-54267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.
- Product
- CM Answers
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update CM Answers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Blocks pro: Missing AuthorizationCVE-2024-54256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.
- Product
- Easy Blocks pro
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update Easy Blocks pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Pinpoint Booking System: Missing AuthorizationCVE-2024-54252 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.5.7
- What to do
- Affects up to 2.9.9.5.7. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple Notification: Missing AuthorizationCVE-2024-54242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.
- Product
- Simple Notification
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Simple Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: Missing AuthorizationCVE-2024-54241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.
- Product
- Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification
- What to do
- Update Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification to the newest version.
Dec 13, 2024Eyewear prescription form: Missing AuthorizationCVE-2024-54239 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.
- Product
- Eyewear prescription form
- Affected
- up to 4.0.18
- What to do
- Affects up to 4.0.18. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Brands for WooCommerce: Missing AuthorizationCVE-2023-44149 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through <= 3.8.2.2.
- Product
- Brands for WooCommerce
- Affected
- up to 3.8.2.2
- What to do
- Affects up to 3.8.2.2. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Comment Blacklist Updater: Missing AuthorizationCVE-2023-44147 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through <= 1.1.0.
- Product
- Comment Blacklist Updater
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Comment Blacklist Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Inactive Logout: Missing AuthorizationCVE-2023-44142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Deepen Bajracharya Inactive Logout inactive-logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through <= 3.2.2.
- Product
- Inactive Logout
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Inactive Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024FluentForm: Missing AuthorizationCVE-2023-41952 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8.
- Product
- FluentForm
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024rtMedia for WordPress, BuddyPress and bbPress: Missing AuthorizationCVE-2023-41951 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Affected
- up to 4.6.14
- What to do
- Affects up to 4.6.14. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Directory Kit: Missing AuthorizationCVE-2023-41875 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.
- Product
- WP Directory Kit
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024SAML SP Single Sign On: Missing AuthorizationCVE-2023-41873 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.
- Product
- SAML SP Single Sign On
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update SAML SP Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Crowdfunding: Missing AuthorizationCVE-2023-41870 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Accessibility Helper (WAH): Missing AuthorizationCVE-2023-41869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4.
- Product
- WP Accessibility Helper (WAH)
- Affected
- up to 0.6.2.4
- What to do
- Affects up to 0.6.2.4. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Automatic YouTube Gallery: Missing AuthorizationCVE-2023-41866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3.
- Product
- Automatic YouTube Gallery
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Automatic YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Slider Pro: Missing AuthorizationCVE-2023-41865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.
- Product
- Slider Pro
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Click To Tweet: Missing AuthorizationCVE-2023-41857 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ClickToTweet.com Click To Tweet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Click To Tweet: from n/a through 2.0.14.
- Product
- Click To Tweet
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update Click To Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Posts Like Dislike: Missing AuthorizationCVE-2023-41849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Like Dislike: from n/a through 1.1.0.
- Product
- Posts Like Dislike
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Posts Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.