Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

6,273 results · page 99 of 126

Jun 21, 2024Sparkle Demo Importer: Unauthorized database reset and demo data importCVE-2024-6120 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all posts, pages, and uploaded files, as well as download and install a limited set of demo plugins.
Product
Sparkle Demo Importer
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Sparkle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024JupiterX Core: Incorrect AuthorizationCVE-2023-38389 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8.
Product
JupiterX Core
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024EmbedPress: Missing AuthorizationCVE-2023-51375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.8.3.
Product
EmbedPress
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WordPress Form Builder Plugin – Gutenberg Forms: Missing AuthorizationCVE-2022-45803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Builder Plugin – Gutenberg Forms: from n/a through 2.2.8.3.
Product
WordPress Form Builder Plugin – Gutenberg Forms
Affected
up to 2.2.8.3
What to do
Affects up to 2.2.8.3. Update WordPress Form Builder Plugin – Gutenberg Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WP Tools: Missing AuthorizationCVE-2022-43453 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Bill Minozzi WP Tools.This issue affects WP Tools: from n/a through 3.41.
Product
WP Tools
Affected
up to 3.41
What to do
Affects up to 3.41. Update WP Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Event Management Tickets Booking: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-5059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0.
Product
Event Management Tickets Booking
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Event Management Tickets Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024phpinfo() WP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35776 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0.
Product
phpinfo() WP
Affected
up to 5.0
What to do
Affects up to 5.0. Update phpinfo() WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages: Unauthorized modification of dataCVE-2024-3961 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tag_subscriber function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to subscribe users to tags. Financial damages may occur to site owners if their API quota is exceeded.
Product
ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 20, 2024WP Child Theme Generator: Unauthorized modification of dataCVE-2024-3610 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.
Product
WP Child Theme Generator
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024Hide Dashboard Notifications: Unauthorized modification of dataCVE-2024-1955 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.
Product
Hide Dashboard Notifications
Affected
up to 1.3
What to do
Affects up to 1.3. Update Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024License Manager for WooCommerce: Unauthorized access of dataCVE-2024-1639 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.
Product
License Manager for WooCommerce
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024Smush: Unauthorized deletion of the resmush listCVE-2023-3352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.
Product
Smush
What to do
Update Smush to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Wheel of Life: Coaching and Assessment Tool for Life Coach: Unauthorized modification and loss of dataCVE-2024-3627 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.
Product
Wheel of Life: Coaching and Assessment Tool for Life Coach
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Wheel of Life: Coaching and Assessment Tool for Life Coach to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer: Unauthorized plugin settings updateCVE-2024-3602 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber access or higher, to remove the Promolayer connection.
Product
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Slider Revolution: Missing AuthorizationCVE-2024-34444 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0.
Product
Slider Revolution
Fixed in
6.7.0
What to do
Update Slider Revolution to 6.7.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Avada: Missing AuthorizationCVE-2023-39312 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
Product
Avada
Affected
up to 7.11.1
What to do
Affects up to 7.11.1. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JupiterX Core: Missing AuthorizationCVE-2023-38394 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.
Product
JupiterX Core
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38393 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Product
Ninja Forms
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024LearnPress: Missing AuthorizationCVE-2023-36516 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
Product
LearnPress
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024LearnPress: Missing AuthorizationCVE-2023-36515 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
Product
LearnPress
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Attorney: Missing AuthorizationCVE-2022-45832 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Hennessey Digital Attorney.This issue affects Attorney: from n/a through 3.
Product
Attorney
Affected
up to 3
What to do
Affects up to 3. Update Attorney to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Fusion Builder: Missing AuthorizationCVE-2023-39310 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
Product
Fusion Builder
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Ship to Multiple Addresses: Missing AuthorizationCVE-2023-37872 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.5.
Product
WooCommerce Ship to Multiple Addresses
Affected
up to 3.8.5
What to do
Affects up to 3.8.5. Update WooCommerce Ship to Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Premium Addons PRO: Missing AuthorizationCVE-2023-37869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
Product
Premium Addons PRO
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Convert Pro: Missing AuthorizationCVE-2023-36684 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.
Product
Convert Pro
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Convert Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Schema Pro: Missing AuthorizationCVE-2023-36683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8.
Product
Schema Pro
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Schema Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Spectra: Missing AuthorizationCVE-2023-36676 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
Product
Spectra
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Premium Starter Templates: Missing AuthorizationCVE-2023-41805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium Starter Templates: from n/a through 3.2.5; Starter Templates: from n/a through 3.2.5.
Product
Premium Starter Templates
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Premium Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Betheme: Missing AuthorizationCVE-2023-39998 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1.
Product
Betheme
Affected
up to 27.1.1
What to do
Affects up to 27.1.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Elements kit Elementor addons: Missing AuthorizationCVE-2023-39993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wpmet Elements kit Elementor addons.This issue affects Elements kit Elementor addons: from n/a through 2.9.0.
Product
Elements kit Elementor addons
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Elements kit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Paid Memberships Pro: Missing AuthorizationCVE-2023-39990 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.
Product
Paid Memberships Pro
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Avada: Missing AuthorizationCVE-2023-39922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
Product
Avada
Affected
up to 7.11.1
What to do
Affects up to 7.11.1. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38386 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Product
Ninja Forms
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-37870 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.1.9.
Product
WooCommerce Warranty Requests
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024AutomateWoo: Missing AuthorizationCVE-2023-36512 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5.
Product
AutomateWoo
Affected
up to 5.7.5
What to do
Affects up to 5.7.5. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Elementor Pro: Missing AuthorizationCVE-2023-35050 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Elementor Elementor Pro.This issue affects Elementor Pro: from n/a through 3.13.0.
Product
Elementor Pro
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Stripe Payment Gateway: Missing AuthorizationCVE-2023-35049 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.4.0.
Product
WooCommerce Stripe Payment Gateway
Affected
up to 7.4.0
What to do
Affects up to 7.4.0. Update WooCommerce Stripe Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Betheme: Missing AuthorizationCVE-2023-47770 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1.
Product
Betheme
Affected
up to 27.1.1
What to do
Affects up to 27.1.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WooCommerce Checkout Manager: Missing AuthorizationCVE-2023-47681 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in QuadLayers WooCommerce Checkout Manager.This issue affects WooCommerce Checkout Manager: from n/a through 7.3.0.
Product
WooCommerce Checkout Manager
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update WooCommerce Checkout Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Themify Ultra: Missing AuthorizationCVE-2023-46148 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Themify Ultra: Missing AuthorizationCVE-2023-46146 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Nexter: Missing AuthorizationCVE-2023-45658 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in POSIMYTH Nexter.This issue affects Nexter: from n/a through 2.0.3.
Product
Nexter
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Nexter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Pre-Publish Checklist: Missing AuthorizationCVE-2023-44151 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1.
Product
Pre-Publish Checklist
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Pre-Publish Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Astra Bulk Edit: Missing AuthorizationCVE-2023-44148 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7.
Product
Astra Bulk Edit
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Astra Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Paid Memberships Pro CCBill Gateway: Missing AuthorizationCVE-2023-40608 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.
Product
Paid Memberships Pro CCBill Gateway
Affected
up to 0.3
What to do
Affects up to 0.3. Update Paid Memberships Pro CCBill Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024All-in-One WP Migration Box Extension: Missing AuthorizationCVE-2023-40004 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue affects All-in-One WP Migration Box Extension: from n/a through 1.53; All-in-One WP Migration OneDrive Extension: from n/a through 1.66; All-in-One WP Migration Dropbox Extension: from n/a through 3.75; All-in-One WP Migration Google Drive Extension: from n/a through 2.79.
Product
All-in-One WP Migration Box Extension
Affected
up to 1.53
What to do
Affects up to 1.53. Update All-in-One WP Migration Box Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48761 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48760 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48759 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Jetpack: Missing AuthorizationCVE-2023-47788 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
Product
Jetpack
Fixed in
12.7
What to do
Update Jetpack to 12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.