Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

468new WordPress flaws this week

392,577entries in the database

6,284 results · page 107 of 126

May 8, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-40218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
Product
Advance WordPress Search
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Multi-column Tag Map: Missing AuthorizationCVE-2023-41651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26.
Product
Multi-column Tag Map
Affected
up to 17.0.26
What to do
Affects up to 17.0.26. Update Multi-column Tag Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 7, 2024Tilda Publishing: Missing AuthorizationCVE-2023-31234 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Tilda Publishing.This issue affects Tilda Publishing: from n/a through 0.3.23.
Product
Tilda Publishing
Affected
up to 0.3.23
What to do
Affects up to 0.3.23. Update Tilda Publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 7, 2024ClickCease Click Fraud Protection: Unauthorized access of dataCVE-2023-6810 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check on the get_settings function in all versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with author access and above, to retrieve the plugin's configured API keys.
Product
ClickCease Click Fraud Protection
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update ClickCease Click Fraud Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2024WidgetKit: Missing AuthorizationCVE-2024-33908 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.
Product
WidgetKit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Print My Blog: Missing AuthorizationCVE-2024-33907 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2.
Product
Print My Blog
Affected
up to 3.26.2
What to do
Affects up to 3.26.2. Update Print My Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WPPizza: Missing AuthorizationCVE-2024-33576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.
Product
WPPizza
Affected
up to 3.18.10
What to do
Affects up to 3.18.10. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Metform: Missing AuthorizationCVE-2024-33570 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3.
Product
Metform
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WP Post Author: Missing AuthorizationCVE-2024-34389 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
Product
WP Post Author
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WP Post Author: Missing AuthorizationCVE-2024-34387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
Product
WP Post Author
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024LeadConnector: Missing AuthorizationCVE-2024-34378 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7.
Product
LeadConnector
Affected
up to 1.7
What to do
Affects up to 1.7. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: Missing AuthorizationCVE-2024-34377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
Product
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Post Grid Master: Missing AuthorizationCVE-2024-34372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.
Product
Post Grid Master
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Login with phone number: Missing AuthorizationCVE-2024-34371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.18.
Product
Login with phone number
Affected
up to 1.7.18
What to do
Affects up to 1.7.18. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Mooberry Book Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12.
Product
Mooberry Book Manager
Affected
up to 4.15.12
What to do
Affects up to 4.15.12. Update Mooberry Book Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Academy LMS: Missing AuthorizationCVE-2024-33912 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.
Product
Academy LMS
Affected
up to 1.9.16
What to do
Affects up to 1.9.16. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Digital Publications by Supsystic: Missing AuthorizationCVE-2024-33910 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.
Product
Digital Publications by Supsystic
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Digital Publications by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024GDPR Compliance: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34388 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
Product
GDPR Compliance
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024SEOPress: Authorization Bypass Through User-Controlled KeyCVE-2024-34383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.
Product
SEOPress
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Robo Gallery: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18.
Product
Robo Gallery
Affected
up to 3.2.18
What to do
Affects up to 3.2.18. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 4, 2024Import and export users and customers: Unauthorized modification of dataCVE-2024-1050 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
Product
Import and export users and customers
Affected
up to 1.26.5
What to do
Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 4, 2024ConvertPlug: Unauthorized modification of dataCVE-2024-3237 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to, and including, 3.5.25. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to true.
Product
ConvertPlug
Affected
up to 3.5.25
What to do
Affects up to 3.5.25. Update ConvertPlug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record convertplug.com wordfence.com
May 3, 2024Progressive WordPress (PWA): Missing AuthorizationCVE-2024-33937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13.
Product
Progressive WordPress (PWA)
Affected
up to 2.1.13
What to do
Affects up to 2.1.13. Update Progressive WordPress (PWA) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024JW Player for: Missing AuthorizationCVE-2024-33931 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3.
Product
JW Player for
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update JW Player for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Directorist: Missing AuthorizationCVE-2024-33929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6.
Product
Directorist
Affected
up to 7.8.6
What to do
Affects up to 7.8.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Embed Google Fonts: Missing AuthorizationCVE-2024-33925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0.
Product
Embed Google Fonts
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Embed Google Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024SP Project & Document Manager: Missing AuthorizationCVE-2024-33923 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.69.
Product
SP Project & Document Manager
Affected
up to 4.69
What to do
Affects up to 4.69. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Democracy Poll: Missing AuthorizationCVE-2024-33920 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3.
Product
Democracy Poll
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Democracy Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024RomethemeKit For Elementor: Missing AuthorizationCVE-2024-33919 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1.
Product
RomethemeKit For Elementor
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update RomethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Debug Log Manager: Missing AuthorizationCVE-2024-33915 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
Product
Debug Log Manager
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Debug Log Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Exclusive Addons Elementor: Missing AuthorizationCVE-2024-33914 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1.
Product
Exclusive Addons Elementor
Affected
up to 2.6.9.1
What to do
Affects up to 2.6.9.1. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-33941 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.1.
Product
iPanorama 360 WordPress Virtual Tour Builder
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024ShortPixel Critical CSS: Missing AuthorizationCVE-2024-32810 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2.
Product
ShortPixel Critical CSS
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update ShortPixel Critical CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Feed Them Social: Missing AuthorizationCVE-2024-24710 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SlickRemix Feed Them Social.This issue affects Feed Them Social: from n/a through 4.2.0.
Product
Feed Them Social
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Feed Them Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Unyson: Missing AuthorizationCVE-2023-44472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.28.
Product
Unyson
Affected
up to 2.7.28
What to do
Affects up to 2.7.28. Update Unyson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Slider Carousel – Responsive Image Slider: Missing AuthorizationCVE-2023-25457 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Richteam Slider Carousel – Responsive Image Slider.This issue affects Slider Carousel – Responsive Image Slider: from n/a through 1.5.1.
Product
Slider Carousel – Responsive Image Slider
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Slider Carousel – Responsive Image Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid: Unauthorized modification of dataCVE-2024-3936 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtTPGSaveSettings function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or higher, to change the plugin's settings and invoke other functions hooked by AJAX actions.
Product
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Popup Box – Best WordPress Popup: Unauthorized access of dataCVE-2024-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.
Product
Popup Box – Best WordPress Popup
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Popup Box – Best WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Datepicker: Unauthorized modification of dataCVE-2024-3895 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax() function in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options that can be used for privilege escalation. This was partially patched in 2.0.9 and 2.1.0, and fully patched in 2.1.1.
Product
WP Datepicker
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024PropertyHive: Unauthorized loss of dataCVE-2024-3607 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts
Product
PropertyHive
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024ProfileGrid – User Profiles, Memberships, Groups and Communities: Unauthorized deletion of dataCVE-2024-3606 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments.
Product
ProfileGrid – User Profiles, Memberships, Groups and Communities
Affected
up to 5.8.3
What to do
Affects up to 5.8.3. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Poll Maker – Best WordPress Poll: Unauthorized access of dataCVE-2024-3601 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll_create_author function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email addresses by enumerating them one character at a time.
Product
Poll Maker – Best WordPress Poll
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Poll Maker – Best WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Unauthorized loss of dataCVE-2024-3599 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Send PDF for Contact Form 7: Unauthorized access of form submissionsCVE-2024-3585 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entries with PDFs.
Product
Send PDF for Contact Form 7
Affected
up to 1.0.2.3
What to do
Affects up to 1.0.2.3. Update Send PDF for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024MaxGalleria: Unauthorized image uploadCVE-2024-3581 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the add_media_library_images_to_gallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to upload arbitrary images to a gallery.
Product
MaxGalleria
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update MaxGalleria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2024-3553 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WordPress Backup & Migration: Unauthorized access of dataCVE-2024-3546 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.
Product
WordPress Backup & Migration
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Country State City Dropdown CF7: Unauthorized modification of dataCVE-2024-3520 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tc_csca_patch_settings function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber access and above, to add states or cities to the dropdown.
Product
Country State City Dropdown CF7
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Country State City Dropdown CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Unauthorized loss of dataCVE-2024-3295 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
Product
User Registration – Custom Registration Form, Login Form, and User Profile
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update User Registration – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.