Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

34added in the last 30 days

563new WordPress flaws this week

392,577entries in the database

6,284 results · page 100 of 126

Jun 19, 2024Themify Ultra: Missing AuthorizationCVE-2023-46148 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Themify Ultra: Missing AuthorizationCVE-2023-46146 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Nexter: Missing AuthorizationCVE-2023-45658 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in POSIMYTH Nexter.This issue affects Nexter: from n/a through 2.0.3.
Product
Nexter
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Nexter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Pre-Publish Checklist: Missing AuthorizationCVE-2023-44151 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1.
Product
Pre-Publish Checklist
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Pre-Publish Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Astra Bulk Edit: Missing AuthorizationCVE-2023-44148 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7.
Product
Astra Bulk Edit
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Astra Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Paid Memberships Pro CCBill Gateway: Missing AuthorizationCVE-2023-40608 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.
Product
Paid Memberships Pro CCBill Gateway
Affected
up to 0.3
What to do
Affects up to 0.3. Update Paid Memberships Pro CCBill Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024All-in-One WP Migration Box Extension: Missing AuthorizationCVE-2023-40004 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue affects All-in-One WP Migration Box Extension: from n/a through 1.53; All-in-One WP Migration OneDrive Extension: from n/a through 1.66; All-in-One WP Migration Dropbox Extension: from n/a through 3.75; All-in-One WP Migration Google Drive Extension: from n/a through 2.79.
Product
All-in-One WP Migration Box Extension
Affected
up to 1.53
What to do
Affects up to 1.53. Update All-in-One WP Migration Box Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48761 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48760 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024JetElements For Elementor: Missing AuthorizationCVE-2023-48759 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
Product
JetElements For Elementor
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Jetpack: Missing AuthorizationCVE-2023-47788 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
Product
Jetpack
Fixed in
12.7
What to do
Update Jetpack to 12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Thrive Theme Builder: Missing AuthorizationCVE-2023-47783 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0.
Product
Thrive Theme Builder
Fixed in
3.24.0
What to do
Update Thrive Theme Builder to 3.24.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Essential Grid: Missing AuthorizationCVE-2023-47771 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in ThemePunch OHG Essential Grid.This issue affects Essential Grid: from n/a through 3.0.18.
Product
Essential Grid
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update Essential Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024MIMO Woocommerce Order Tracking: Unauthorized modification of dataCVE-2024-5768 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_update_provider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update shipping provider information, including adding stored cross-site scripting.
Product
MIMO Woocommerce Order Tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update MIMO Woocommerce Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024AliExpress Dropshipping with AliNext Lite: Unauthorized accessCVE-2024-4450 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifying products. CVE-2024-37210 is likely a duplicate of this issue.
Product
AliExpress Dropshipping with AliNext Lite
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update AliExpress Dropshipping with AliNext Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2024Login with phone number: Unauthorized password resetsCVE-2024-6125 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing a 6-digit numeric reset code.
Product
Login with phone number
Affected
up to 1.7.34
What to do
Affects up to 1.7.34. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 18, 2024Tickera – WordPress Event Ticketing: Unauthorized loss of dataCVE-2024-5860 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all tickets associated with events.
Product
Tickera – WordPress Event Ticketing
Affected
up to 3.5.2.8
What to do
Affects up to 3.5.2.8. Update Tickera – WordPress Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 17, 2024Ibtana – WordPress Website Builder: Unauthorized modification of dataCVE-2024-5541 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated attackers to update option values for reCAPTCHA keys on the WordPress site. This can be leveraged to bypass reCAPTCHA on the site. CVE-2024-37123 is likely a duplicate of this issue.
Product
Ibtana – WordPress Website Builder
Affected
up to 1.2.3.3
What to do
Affects up to 1.2.3.3. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2024Scheduling Plugin – Online Booking for: Unauthorized loss of dataCVE-2024-1634 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for unauthenticated attackers to disconnect the plugin from the startbooking service and remove connection data.
Product
Scheduling Plugin – Online Booking for
Affected
up to 3.5.10
What to do
Affects up to 3.5.10. Update Scheduling Plugin – Online Booking for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 15, 2024AI Infographic Maker: Unauthorized modification of dataCVE-2024-5858 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post titles.
Product
AI Infographic Maker
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update AI Infographic Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2024FooEvents for WooCommerce: Unauthorized arbitrary file uploadsCVE-2024-6000 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21.
Product
FooEvents for WooCommerce
Affected
up to 1.19.20
What to do
Affects up to 1.19.20. Update FooEvents for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record help.fooevents.com wordfence.com
Jun 14, 2024Popup Builder: Unauthorized modification of data and loss of dataCVE-2024-2544 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.
Product
Popup Builder
Fixed in
4.3.2
What to do
Update Popup Builder to 4.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2024Popup Builder – Create highly converting, mobile friendly marketing popups.: Unauthorized access of functionalityCVE-2023-6696 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side Request Forgery.
Product
Popup Builder – Create highly converting, mobile friendly marketing popups.
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Popup Builder – Create highly converting, mobile friendly marketing popups. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024ProjectHuddle Client Site: Missing AuthorizationCVE-2023-51376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34.
Product
ProjectHuddle Client Site
Affected
up to 1.0.34
What to do
Affects up to 1.0.34. Update ProjectHuddle Client Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024LatePoint: Unauthorized access of data and modification of dataCVE-2024-2472 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
Product
LatePoint
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record aramhairchitects.nl websec.nl
Jun 14, 2024Ninja Tables: Missing AuthorizationCVE-2024-23504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.
Product
Ninja Tables
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Ship to Multiple Addresses: Missing AuthorizationCVE-2023-51497 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.
Product
WooCommerce Ship to Multiple Addresses
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update WooCommerce Ship to Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-51496 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
Product
WooCommerce Warranty Requests
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024WooCommerce Warranty Requests: Missing AuthorizationCVE-2023-51495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
Product
WooCommerce Warranty Requests
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WooCommerce Warranty Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Everest Forms: Missing AuthorizationCVE-2023-51377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3.
Product
Everest Forms
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling: Unauthorized modification of dataCVE-2024-1094 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.
Product
Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2024WooCommerce Easy Duplicate Product: Missing AuthorizationCVE-2023-51523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7.
Product
WooCommerce Easy Duplicate Product
Affected
up to 0.3.0.7
What to do
Affects up to 0.3.0.7. Update WooCommerce Easy Duplicate Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Business Directory: Missing AuthorizationCVE-2023-51516 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Business Directory Team Business Directory Plugin.This issue affects Business Directory Plugin: from n/a through 6.3.9.
Product
Business Directory
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Quiz And Survey Master: Missing AuthorizationCVE-2023-51507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
Product
Quiz And Survey Master
Affected
up to 8.1.16
What to do
Affects up to 8.1.16. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2023-37394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0.
Product
WP Dummy Content Generator
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Sublanguage: Missing AuthorizationCVE-2023-36695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9.
Product
Sublanguage
Affected
up to 2.9
What to do
Affects up to 2.9. Update Sublanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Kingkong Board: Missing AuthorizationCVE-2023-36694 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
Product
Kingkong Board
Affected
up to 2.1.0.2
What to do
Affects up to 2.1.0.2. Update Kingkong Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024BBS e-Popup: Missing AuthorizationCVE-2023-36504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
Product
BBS e-Popup
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update BBS e-Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Fat Rat Collect: Missing AuthorizationCVE-2023-35045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fat Rat Fat Rat Collect.This issue affects Fat Rat Collect: from n/a through 2.6.7.
Product
Fat Rat Collect
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Fat Rat Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024SendPress Newsletters: Missing AuthorizationCVE-2023-35040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6.
Product
SendPress Newsletters
Affected
up to 1.23.11.6
What to do
Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024SKU Label Changer For WooCommerce: Missing AuthorizationCVE-2023-29174 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0.
Product
SKU Label Changer For WooCommerce
Affected
up to 3.0
What to do
Affects up to 3.0. Update SKU Label Changer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2024Download Manager: Unauthorized access of dataCVE-2024-2098 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.
Product
Download Manager
Affected
up to 3.2.89
What to do
Affects up to 3.2.89. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024Newsletter - API v1 and v2 addon: Unauthorized subscribers managementCVE-2024-5674 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0
Product
Newsletter - API v1 and v2 addon
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Newsletter - API v1 and v2 addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record thenewsletterplugin.com wordfence.com
Jun 12, 2024weForms: Missing AuthorizationCVE-2023-51524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
Product
weForms
Affected
up to 1.6.18
What to do
Affects up to 1.6.18. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Piotnet Forms: Missing AuthorizationCVE-2023-51413 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.29.
Product
Piotnet Forms
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Consensu.Io: Missing AuthorizationCVE-2023-48280 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Consensu.IO Consensu.Io.This issue affects Consensu.Io: from n/a through 1.0.1.
Product
Consensu.Io
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Consensu.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024wpMandrill: Missing AuthorizationCVE-2023-47828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.
Product
wpMandrill
Affected
up to 1.33
What to do
Affects up to 1.33. Update wpMandrill to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024WP GPX Map: Missing AuthorizationCVE-2023-44234 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bastianon Massimo WP GPX Map.This issue affects WP GPX Map: from n/a through 1.7.08.
Product
WP GPX Map
Affected
up to 1.7.08
What to do
Affects up to 1.7.08. Update WP GPX Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Pricing Deals for WooCommerce: Missing AuthorizationCVE-2023-41240 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vark Pricing Deals for WooCommerce.This issue affects Pricing Deals for WooCommerce: from n/a through 2.0.3.2.
Product
Pricing Deals for WooCommerce
Affected
up to 2.0.3.2
What to do
Affects up to 2.0.3.2. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Sticky Social Media Icons: Missing AuthorizationCVE-2023-40672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1.
Product
Sticky Social Media Icons
Affected
up to 2.1
What to do
Affects up to 2.1. Update Sticky Social Media Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.