Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,269 results · page 83 of 126
Dec 13, 2024Carousel Slider: Missing AuthorizationCVE-2023-41848 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carousel Slider: from n/a through 2.2.2.
- Product
- Carousel Slider
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024BitPay Checkout for WooCommerce: Missing AuthorizationCVE-2023-41803 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0.
- Product
- BitPay Checkout for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update BitPay Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Super Socializer: Missing AuthorizationCVE-2023-41802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54.
- Product
- Super Socializer
- Affected
- up to 7.13.54
- What to do
- Affects up to 7.13.54. Update Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Analytify: Missing AuthorizationCVE-2023-41695 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.1.0.
- Product
- Analytify
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WiserNotify Social Proof: Missing AuthorizationCVE-2023-41690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wiser Notify WiserNotify Social Proof allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserNotify Social Proof: from n/a through 2.5.
- Product
- WiserNotify Social Proof
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update WiserNotify Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Post to Google My Business (Google Business Profile): Missing AuthorizationCVE-2023-41689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.
- Product
- Post to Google My Business (Google Business Profile)
- Affected
- up to 3.1.14
- What to do
- Affects up to 3.1.14. Update Post to Google My Business (Google Business Profile) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Bulk NoIndex & NoFollow Toolkit: Missing AuthorizationCVE-2023-41688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through 1.5.
- Product
- Bulk NoIndex & NoFollow Toolkit
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024TelSender: Missing AuthorizationCVE-2023-41683 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Pechenki TelSender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TelSender: from n/a through 1.14.11.
- Product
- TelSender
- Affected
- up to 1.14.11
- What to do
- Affects up to 1.14.11. Update TelSender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Abandoned Cart Lite for WooCommerce: Missing AuthorizationCVE-2023-41671 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in tychesoftwares Abandoned Cart Lite for WooCommerce woocommerce-abandoned-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Cart Lite for WooCommerce: from n/a through <= 5.16.1.
- Product
- Abandoned Cart Lite for WooCommerce
- Affected
- up to 5.16.1
- What to do
- Affects up to 5.16.1. Update Abandoned Cart Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Newsletter Signups: Missing AuthorizationCVE-2023-41664 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AlphaBPO Easy Newsletter Signups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Newsletter Signups: from n/a through 1.0.4.
- Product
- Easy Newsletter Signups
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ovic Product Bundle: Missing AuthorizationCVE-2023-41649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ovic Team Ovic Product Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovic Product Bundle: from n/a through 1.1.2.
- Product
- Ovic Product Bundle
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ovic Product Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Category Slider for WooCommerce: Missing AuthorizationCVE-2023-41132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ShapedPlugin LLC Category Slider for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Category Slider for WooCommerce: from n/a through 1.4.15.
- Product
- Category Slider for WooCommerce
- Affected
- up to 1.4.15
- What to do
- Affects up to 1.4.15. Update Category Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Premmerce User Roles: Missing AuthorizationCVE-2023-41130 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.12.
- Product
- Premmerce User Roles
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple URLs: Missing AuthorizationCVE-2023-40678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Andrew Fiebert Simple URLs simple-urls allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through <= 117.
- Product
- Simple URLs
- Affected
- up to 117
- What to do
- Affects up to 117. Update Simple URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ReviewX: Missing AuthorizationCVE-2023-40670 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ReviewX Team ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.17.
- Product
- ReviewX
- Affected
- up to 1.6.17
- What to do
- Affects up to 1.6.17. Update ReviewX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024HUSKY: Missing AuthorizationCVE-2023-40334 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 HUSKY woocommerce-products-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HUSKY: from n/a through <= 1.3.4.2.
- Product
- HUSKY
- Affected
- up to 1.3.4.2
- What to do
- Affects up to 1.3.4.2. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Accordion Slider: Missing AuthorizationCVE-2023-40331 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider: from n/a through 1.9.6.
- Product
- Accordion Slider
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Justified Gallery: Missing AuthorizationCVE-2023-40213 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mateusz Czardybon Justified Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justified Gallery: from n/a through 1.7.3.
- Product
- Justified Gallery
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Justified Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024MailChimp Forms by MailMunch: Missing AuthorizationCVE-2023-40203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4.
- Product
- MailChimp Forms by MailMunch
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Cost Calculator Builder: Missing AuthorizationCVE-2023-40011 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Cost Calculator Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator Builder: from n/a through 3.1.42.
- Product
- Cost Calculator Builder
- Affected
- up to 3.1.42
- What to do
- Affects up to 3.1.42. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Digital Downloads: Missing AuthorizationCVE-2023-40005 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through <= 3.1.5.
- Product
- Easy Digital Downloads
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Project Manager: Missing AuthorizationCVE-2023-40003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in weDevs WP Project Manager wedevs-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Project Manager: from n/a through <= 2.6.7.
- Product
- WP Project Manager
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024iThemes Sync: Missing AuthorizationCVE-2023-40001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13.
- Product
- iThemes Sync
- Affected
- up to 2.1.13
- What to do
- Affects up to 2.1.13. Update iThemes Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-39997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.19
- What to do
- Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Accordion and Accordion Slider: Missing AuthorizationCVE-2023-39996 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Accordion and Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion and Accordion Slider: from n/a through 1.2.4.
- Product
- Accordion and Accordion Slider
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Accordion and Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Portfolio and Projects: Missing AuthorizationCVE-2023-39995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7.
- Product
- Portfolio and Projects
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Redirection for Contact Form 7: Missing AuthorizationCVE-2023-39920 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.
- Product
- Redirection for Contact Form 7
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Yet Another Stars Rating: Missing AuthorizationCVE-2023-39305 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through <= 3.4.3.
- Product
- Yet Another Stars Rating
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Yet Another Stars Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Social Share Icons & Social Share Buttons: Missing AuthorizationCVE-2023-38514 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7.
- Product
- Social Share Icons & Social Share Buttons
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Social Share Icons & Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Instant CSS: Missing AuthorizationCVE-2023-38483 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dylan Blokhuis Instant CSS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through 1.1.4.
- Product
- Instant CSS
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Instant CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Booster Elementor Addons: Missing AuthorizationCVE-2023-38480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Certain Dev Booster Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster Elementor Addons: from n/a through 1.4.9.
- Product
- Booster Elementor Addons
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Booster Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Simple Googlebot Visit: Missing AuthorizationCVE-2023-38479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codents Simple Googlebot Visit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Googlebot Visit: from n/a through 1.2.4.
- Product
- Simple Googlebot Visit
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Simple Googlebot Visit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024QR code MeCard/vCard generator: Missing AuthorizationCVE-2023-38477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0.
- Product
- QR code MeCard/vCard generator
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update QR code MeCard/vCard generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Donations Made Easy – Smart Donations: Missing AuthorizationCVE-2023-38475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
- Product
- Donations Made Easy – Smart Donations
- Affected
- up to 4.0.12
- What to do
- Affects up to 4.0.12. Update Donations Made Easy – Smart Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JupiterX Core: Missing AuthorizationCVE-2023-38385 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
- Product
- JupiterX Core
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Language: Missing AuthorizationCVE-2023-38383 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1.
- Product
- Language
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easyship WooCommerce Shipping Rates: Missing AuthorizationCVE-2023-37989 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Easyship Easyship WooCommerce Shipping Rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easyship WooCommerce Shipping Rates: from n/a through 0.9.0.
- Product
- Easyship WooCommerce Shipping Rates
- Affected
- up to 0.9.0
- What to do
- Affects up to 0.9.0. Update Easyship WooCommerce Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024YourMembership Single Sign On: Missing AuthorizationCVE-2023-37987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.
- Product
- YourMembership Single Sign On
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update YourMembership Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-37984 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.
- Product
- Quiz And Survey Master
- Affected
- up to 8.1.10
- What to do
- Affects up to 8.1.10. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WooCommerce Product Stock Alert: Missing AuthorizationCVE-2023-37971 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Checkout with Zelle on Woocommerce: Missing AuthorizationCVE-2023-37969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1.
- Product
- Checkout with Zelle on Woocommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Checkout with Zelle on Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024DirectoryPress: Missing AuthorizationCVE-2023-37967 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.
- Product
- DirectoryPress
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WPSchoolPress: Missing AuthorizationCVE-2023-37887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPSchoolPress Team WPSchoolPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through 2.2.7.
- Product
- WPSchoolPress
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Cryptocurrency Widgets – Price Ticker & Coins List: Missing AuthorizationCVE-2023-36681 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.2.
- Product
- Cryptocurrency Widgets – Price Ticker & Coins List
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Cryptocurrency Widgets – Price Ticker & Coins List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Image Regenerate & Select Crop: Missing AuthorizationCVE-2023-36680 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0.
- Product
- Image Regenerate & Select Crop
- Affected
- up to 7.1.0
- What to do
- Affects up to 7.1.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024LiquidPoll – Advanced Polls for Creators and Brands: Missing AuthorizationCVE-2023-36531 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68.
- Product
- LiquidPoll – Advanced Polls for Creators and Brands
- Affected
- up to 3.3.68
- What to do
- Affects up to 3.3.68. Update LiquidPoll – Advanced Polls for Creators and Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024kk Star Ratings: Missing AuthorizationCVE-2023-36528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3.
- Product
- kk Star Ratings
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update kk Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Duplicate Post Page Menu & Custom Post Type: Missing AuthorizationCVE-2023-36526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.
- Product
- Duplicate Post Page Menu & Custom Post Type
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Duplicate Post Page Menu & Custom Post Type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024SW Product Bundles: Missing AuthorizationCVE-2023-36519 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.
- Product
- SW Product Bundles
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update SW Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Post Hit Counter: Missing AuthorizationCVE-2023-36518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2.
- Product
- Post Hit Counter
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Post Hit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.