Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

6,269 results · page 85 of 126

Dec 13, 2024CURCY: Missing AuthorizationCVE-2022-46796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme CURCY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.1.25.
Product
CURCY
Affected
up to 2.1.25
What to do
Affects up to 2.1.25. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2022-46795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Robo Gallery: Missing AuthorizationCVE-2022-45841 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9.
Product
Robo Gallery
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Auto Affiliate Links: Missing AuthorizationCVE-2022-45840 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.
Product
Auto Affiliate Links
Affected
up to 6.2.1.5
What to do
Affects up to 6.2.1.5. Update Auto Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2022-45826 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.
Product
Sunshine Photo Cart
Affected
up to 2.9.13
What to do
Affects up to 2.9.13. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Popup Maker: Missing AuthorizationCVE-2022-45819 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1.
Product
Popup Maker
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Formidable Forms: Missing AuthorizationCVE-2022-45806 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.
Product
Formidable Forms
Affected
up to 5.5.4
What to do
Affects up to 5.5.4. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Owl Carousel: Missing AuthorizationCVE-2022-44578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3.
Product
Owl Carousel
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update Owl Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024eRoom – Zoom Meetings & Webinar: Missing AuthorizationCVE-2022-43472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.
Product
eRoom – Zoom Meetings & Webinar
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update eRoom – Zoom Meetings & Webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Crowdfunding: Unauthorized plugin installationCVE-2024-11911 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement.
Product
WP Crowdfunding
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Unauthorized loss of dataCVE-2024-11275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Product
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024AR for: Unauthorized double extension file uploadCVE-2024-12300 · WordPress plugins & themes · reported by WordfenceLow 3.7
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.
Product
AR for
Affected
up to 7.3
What to do
Affects up to 7.3. Update AR for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Essential Real Estate: Unauthorized access of dataCVE-2024-12329 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
Product
Essential Real Estate
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Hash Form – Drag & Drop Form Builder: Unauthorized accessCVE-2024-12201 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy): Unauthorized modification of dataCVE-2024-11724 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpl_script_save AJAX action in all versions up to, and including, 3.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to whitelist scripts.
Product
Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy)
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Web3 Crypto Payments by DePay for WooCommerce: Unauthorized access of dataCVE-2024-12265 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation.
Product
Web3 Crypto Payments by DePay for WooCommerce
Affected
up to 2.12.17
What to do
Affects up to 2.12.17. Update Web3 Crypto Payments by DePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Child Theme Creator by Orbisius: Unauthorized modification of dataCVE-2024-12263 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete cloud snippets. Please note that this vulnerability was present in the Cloud Library Addon used by the plugin and not in the plugin itself, the cloud library has been removed entirely.
Product
Child Theme Creator by Orbisius
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Child Theme Creator by Orbisius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Unauthorized accessCVE-2024-12172 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
Product
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Snippet Shortcodes: Unauthorized Shortcode DeletionCVE-2024-12018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Shortcodes.
Product
Snippet Shortcodes
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 12, 2024Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Unauthorized arbitrary plugin installation and activationCVE-2024-10124 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
Product
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024AI Post Generator | AutoWriter: Unauthorized modification of dataCVE-2024-11709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary pages and posts.
Product
AI Post Generator | AutoWriter
Affected
up to 3.5
What to do
Affects up to 3.5. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Custom Skins Contact Form 7: Unauthorized modification of dataCVE-2024-12341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7cs_action_callback' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the content of any post and create new skins.
Product
Custom Skins Contact Form 7
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Skins Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024WP Service Payment Form With Authorize.net: Reflected Cross-Site ScriptingCVE-2024-12258 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Service Payment Form With Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Service Payment Form With Authorize.net
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024de:branding: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11443 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the debranding_save() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
de:branding
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update de:branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
Product
RapidLoad – Optimize Web Vitals Automatically
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024Notibar: Missing AuthorizationCVE-2024-54269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team Notibar notibar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notibar: from n/a through <= 2.1.4.
Product
Notibar
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Notibar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 10, 2024WPForms: Unauthorized modification of dataCVE-2024-11205 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.
Product
WPForms
Affected
up to 1.9.2.1
What to do
Affects up to 1.9.2.1. Update WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024AIO Contact: Missing AuthorizationCVE-2024-54218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.
Product
AIO Contact
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update AIO Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Analytify: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.
Product
Analytify
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Jobify: Missing AuthorizationCVE-2024-52480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Astoundify Jobify jobify.This issue affects Jobify: from n/a through < 4.3.0.
Product
Jobify
Fixed in
4.2.4
What to do
Update Jobify to 4.2.4 or newer.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Pie Register Premium: Missing AuthorizationCVE-2024-52391 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
Product
Pie Register Premium
Fixed in
3.8.3.3
What to do
Update Pie Register Premium to 3.8.3.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-41953 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.
Product
ProfilePress
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Message Filter for Contact Form 7: Missing AuthorizationCVE-2024-54254 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.
Product
Message Filter for Contact Form 7
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Prodigy Commerce: Missing AuthorizationCVE-2024-54251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through <= 3.1.2.
Product
Prodigy Commerce
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Minimum and Maximum Quantity for WooCommerce: Missing AuthorizationCVE-2024-54227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCommerce: from n/a through <= 2.0.0.
Product
Minimum and Maximum Quantity for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Minimum and Maximum Quantity for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024ARForms: Missing AuthorizationCVE-2024-54217 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1.
Product
ARForms
Affected
up to 6.4.1
What to do
Affects up to 6.4.1. Update ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2024-53819 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.0.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.0
What to do
Affects up to 20.8.0. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Tutor LMS Elementor Addons: Missing AuthorizationCVE-2024-53816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a through <= 2.1.5.
Product
Tutor LMS Elementor Addons
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024FloristPress: Missing AuthorizationCVE-2024-53798 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion.This issue affects FloristPress: from n/a through <= 7.3.0.
Product
FloristPress
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update FloristPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Chatter: Missing AuthorizationCVE-2024-53785 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Alexander Volkov Chatter.This issue affects Chatter: from n/a through 1.0.1.
Product
Chatter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Chatter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Sweet Date: Missing AuthorizationCVE-2024-43222 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3.
Product
Sweet Date
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update Sweet Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024My Sticky Elements: Missing AuthorizationCVE-2023-51362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.
Product
My Sticky Elements
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-51360 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
Product
Essential Blocks for Gutenberg
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2023-51359 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.
Product
Essential Blocks for Gutenberg
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Conversios.io: Missing AuthorizationCVE-2023-51357 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 6.5.0.
Product
Conversios.io
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024MultiVendorX: Missing AuthorizationCVE-2023-51355 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through <= 4.0.23.
Product
MultiVendorX
Affected
up to 4.0.23
What to do
Affects up to 4.0.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-51353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through <= 1.10.19.
Product
Popup by Supsystic
Affected
up to 1.10.19
What to do
Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Poll Maker: Missing AuthorizationCVE-2023-50904 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.8.0.
Product
Poll Maker
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Metform: Missing AuthorizationCVE-2023-50903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.
Product
Metform
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2023-50899 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.2.
Product
Product Catalog Enquiry for WooCommerce by MultiVendorX
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.