Updated 56 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

570 results · page 9 of 12

Jun 10, 2024Under Construction / Maintenance Mode from Acurax: Authentication Bypass by SpoofingCVE-2024-35749 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.
Product
Under Construction / Maintenance Mode from Acurax
Affected
up to 2.6
What to do
Affects up to 2.6. Update Under Construction / Maintenance Mode from Acurax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Contact Form Builder, Contact Widget: Improper Restriction of Excessive Authentication AttemptsCVE-2024-35747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7.
Product
Contact Form Builder, Contact Widget
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Contact Form Builder, Contact Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Integrate Google Drive: Broken AuthenticationCVE-2024-35670 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93.
Product
Integrate Google Drive
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Malware Scanner: Authentication Bypass by SpoofingCVE-2023-52176 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.
Product
Malware Scanner
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Rate my Post – WP Rating System: Authentication Bypass by SpoofingCVE-2023-51667 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2.
Product
Rate my Post – WP Rating System
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024RegistrationMagic: Authentication Bypass by SpoofingCVE-2023-51543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
Product
RegistrationMagic
Affected
up to 5.2.5.0
What to do
Affects up to 5.2.5.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Branda: Authentication Bypass by SpoofingCVE-2023-51542 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.
Product
Branda
Affected
up to 3.4.14
What to do
Affects up to 3.4.14. Update Branda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Booster Elite for WooCommerce: Improper AuthenticationCVE-2023-51511 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3.
Product
Booster Elite for WooCommerce
Fixed in
7.1.3
What to do
Update Booster Elite for WooCommerce to 7.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Coming soon and Maintenance mode: Authentication Bypass by SpoofingCVE-2023-49741 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.
Product
Coming soon and Maintenance mode
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update Coming soon and Maintenance mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Restricted Site Access: Authentication Bypass by SpoofingCVE-2023-48753 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.
Product
Restricted Site Access
Affected
up to 7.4.1
What to do
Affects up to 7.4.1. Update Restricted Site Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Booster for WooCommerce: Improper AuthenticationCVE-2023-48747 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster for WooCommerce: from n/a through 7.1.2.
Product
Booster for WooCommerce
Affected
up to 7.1.2
What to do
Affects up to 7.1.2. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Captcha Code: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48745 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.
Product
Captcha Code
Affected
up to 2.9
What to do
Affects up to 2.9. Update Captcha Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48318 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.
Product
Contact Form Email
Affected
up to 1.3.41
What to do
Affects up to 1.3.41. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Form Maker by 10Web: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48290 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.
Product
Form Maker by 10Web
Affected
up to 1.15.20
What to do
Affects up to 1.15.20. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Forms Puzzle Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Maspik – Spam blacklist: Authentication Bypass by SpoofingCVE-2023-48271 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.
Product
Maspik – Spam blacklist
Affected
up to 0.10.3
What to do
Affects up to 0.10.3. Update Maspik – Spam blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Maintenance: Authentication Bypass by SpoofingCVE-2023-47769 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Maintenance: from n/a through 6.1.3.
Product
WP Maintenance
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update WP Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Defender Security: Improper AuthenticationCVE-2023-47189 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.
Product
Defender Security
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Admin and Site Enhancements (ASE): Improper AuthenticationCVE-2023-46630 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Authentication vulnerability in wpase Admin and Site Enhancements (ASE) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Admin and Site Enhancements (ASE): from n/a through 5.7.1.
Product
Admin and Site Enhancements (ASE)
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Captcha/Honeypot for Contact Form 7: Improper Restriction of Excessive Authentication AttemptsCVE-2023-45009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.
Product
Captcha/Honeypot for Contact Form 7
Affected
up to 1.11.3
What to do
Affects up to 1.11.3. Update Captcha/Honeypot for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-44235 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.
Product
WP Captcha
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Antispam Bee: Authentication Bypass by SpoofingCVE-2023-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.
Product
Antispam Bee
Affected
up to 2.11.3
What to do
Affects up to 2.11.3. Update Antispam Bee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Download IP2Location Country Blocker: Authentication Bypass by SpoofingCVE-2023-37865 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Download IP2Location Country Blocker: from n/a through 2.29.1.
Product
Download IP2Location Country Blocker
Affected
up to 2.29.1
What to do
Affects up to 2.29.1. Update Download IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Hide My WP Ghost: Improper Restriction of Excessive Authentication AttemptsCVE-2023-34001 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in WPPlugins – WordPress Security Plugins Hide My WP Ghost allows Functionality Bypass.This issue affects Hide My WP Ghost: from n/a through 5.0.25.
Product
Hide My WP Ghost
Affected
up to 5.0.25
What to do
Affects up to 5.0.25. Update Hide My WP Ghost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Social Login Lite For WooCommerce: Authentication bypassCVE-2024-4552 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insufficient verification on the user being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
Social Login Lite For WooCommerce
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Social Login Lite For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 3, 2024Spectra: Improper Restriction of Excessive Authentication AttemptsCVE-2023-23730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.
Product
Spectra
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 28, 2024Swiss Toolkit For WP: Authentication bypassCVE-2024-5204 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated attackers with contributor-level and above permissions to log in as any existing user on the site, such as an administrator.
Product
Swiss Toolkit For WP
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2024Login with phone number: Authentication bypassCVE-2024-5150 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27.
Product
Login with phone number
Affected
up to 1.7.26
Fixed in
1.7.27
What to do
Update Login with phone number to 1.7.27 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2024Pie Register - Social Sites Login (Add on): Authentication bypassCVE-2024-4544 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
Pie Register - Social Sites Login (Add on)
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Pie Register - Social Sites Login (Add on) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024Giveaways and Contests: Authentication Bypass by SpoofingCVE-2024-32827 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: from n/a through 1.12.7.
Product
Giveaways and Contests
Affected
up to 1.12.7
What to do
Affects up to 1.12.7. Update Giveaways and Contests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Royal Elementor Addons: Authentication Bypass by SpoofingCVE-2024-32786 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
Product
Royal Elementor Addons
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ProfileGrid: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32774 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affects ProfileGrid : from n/a through 5.8.2.
Product
ProfileGrid
Affected
up to 5.8.2
What to do
Affects up to 5.8.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Appointment Hour Booking: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32720 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Appointment Hour Booking allows Removing Important Client Functionality.This issue affects Appointment Hour Booking: from n/a through 1.4.56.
Product
Appointment Hour Booking
Affected
up to 1.4.56
What to do
Affects up to 1.4.56. Update Appointment Hour Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Maintenance Mode: Authentication Bypass by SpoofingCVE-2024-32708 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in helderk Maintenance Mode allows Functionality Bypass.This issue affects Maintenance Mode: from n/a through 3.0.1.
Product
Maintenance Mode
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WTI Like Post: Authentication Bypass by SpoofingCVE-2024-33917 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1.4.6.
Product
WTI Like Post
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update WTI Like Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Newsletter: Authentication Bypass by SpoofingCVE-2024-30522 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: from n/a through 8.2.0.
Product
Newsletter
Affected
up to 8.2.0
What to do
Affects up to 8.2.0. Update Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024CGC Maintenance Mode: Authentication Bypass by SpoofingCVE-2024-30480 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode: from n/a through 1.2.
Product
CGC Maintenance Mode
Affected
up to 1.2
What to do
Affects up to 1.2. Update CGC Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024IP Blocker Lite: Authentication Bypass by SpoofingCVE-2024-30479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through 11.1.1.
Product
IP Blocker Lite
Affected
up to 11.1.1
What to do
Affects up to 11.1.1. Update IP Blocker Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Comments Like Dislike: Authentication Bypass by SpoofingCVE-2024-25906 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authentication Bypass by Spoofing vulnerability in WP Happy Coders Comments Like Dislike allows Functionality Bypass.This issue affects Comments Like Dislike: from n/a through 1.2.2.
Product
Comments Like Dislike
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Comments Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Defender Security: Authentication Bypass by SpoofingCVE-2024-25595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.
Product
Defender Security
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WordPress Manutenção: Authentication Bypass by SpoofingCVE-2024-22139 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Filipe Seabra WordPress Manutenção allows Functionality Bypass.This issue affects WordPress Manutenção: from n/a through 1.0.6.
Product
WordPress Manutenção
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WordPress Manutenção to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Wp Ultimate Review: Authentication Bypass by SpoofingCVE-2024-21746 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review: from n/a through <= 2.3.6.
Product
Wp Ultimate Review
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Simple Membership: Improper AuthenticationCVE-2023-41956 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.
Product
Simple Membership
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 7, 2024Social Connect: Authentication bypassCVE-2024-4393 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
Social Connect
Affected
up to 1.2
What to do
Affects up to 1.2. Update Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 7, 2024Edwiser Bridge: Authentication bypassCVE-2024-4186 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Edwiser Bridge plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verification_key' default value is empty, and the not empty check is missing in the 'eb_user_email_verify' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This can only be exploited if the 'Email Verification' setting is enabled.
Product
Edwiser Bridge
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 30, 2024Customer Email Verification for WooCommerce: Email Verification and Authentication BypassCVE-2024-4185 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.
Product
Customer Email Verification for WooCommerce
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Customer Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Login as User or Customer (User Switching): Improper AuthenticationCVE-2023-51484 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.
Product
Login as User or Customer (User Switching)
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login as User or Customer (User Switching) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Eazy Plugin Manager: Improper AuthenticationCVE-2023-51482 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eazy Plugin Manager: from n/a through 4.1.2.
Product
Eazy Plugin Manager
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Eazy Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Build App Online: Improper AuthenticationCVE-2023-51478 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.
Product
Build App Online
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.