Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

506new WordPress flaws this week

392,772entries in the database

6,287 results · page 111 of 126

Apr 9, 2024AI Post Generator | AutoWriter: Unauthorized access, modification or deletion of postsCVE-2024-1850 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin (even in non-published status), create new posts (and publish them), publish unpublished post or perform post deletions. CVE-2024-32713 may be a duplicate of this issue.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Accordion: Unauthorized access of data and modification of dataCVE-2024-1641 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts.
Product
Accordion
Affected
up to 2.2.96
What to do
Affects up to 2.2.96. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024360 Javascript Viewer: Unauthorized modification of dataCVE-2024-1637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings.
Product
360 Javascript Viewer
Affected
up to 1.7.12
What to do
Affects up to 1.7.12. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Happy Addons for Elementor: Unauthorized access of dataCVE-2024-1387 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.
Product
Happy Addons for Elementor
Affected
up to 3.10.4
What to do
Affects up to 3.10.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Unauthorized access & modification of dataCVE-2024-1352 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Cloak Affiliate Links: Unauthorized modification of dataCVE-2024-1308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.
Product
WooCommerce Cloak Affiliate Links
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update WooCommerce Cloak Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Clover Payment Gateway: Unauthorized modification of dataCVE-2024-0626 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark orders as paid.
Product
WooCommerce Clover Payment Gateway
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WooCommerce Clover Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Pods – Custom Content Types and Fields: Missing AuthorizationCVE-2023-6965 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This is due to the fact that the plugin allows the use of a file inclusion feature via shortcode. This makes it possible for authenticated attackers, with contributor access or higher, to create pods and users (with default role).
Product
Pods – Custom Content Types and Fields
Affected
up to 3.0.10
What to do
Affects up to 3.0.10. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31368 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
Product
Soledad
Affected
up to 8.4.2
What to do
Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
Product
Soledad
Affected
up to 8.4.2
What to do
Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Post Type Builder (PTB): Missing AuthorizationCVE-2024-31366 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.
Product
Post Type Builder (PTB)
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Post Type Builder (PTB) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024WP2LEADS: Missing AuthorizationCVE-2024-31375 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads.This issue affects WP2LEADS: from n/a through <= 3.2.7.
Product
WP2LEADS
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024BookingPress: Authorization Bypass Through User-Controlled KeyCVE-2024-31296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
Product
BookingPress
Affected
up to 1.0.81
What to do
Affects up to 1.0.81. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-31291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
Product
ProfileGrid
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized modification of dataCVE-2024-3216 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2024WP-Stateless – Google Cloud Storage: Unauthorized loss of dataCVE-2024-1385 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
Product
WP-Stateless – Google Cloud Storage
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update WP-Stateless – Google Cloud Storage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2024Image Watermark: Unauthorized modification of dataCVE-2024-1994 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() function in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to apply and remove watermarks from images.
Product
Image Watermark
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Image Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 2, 2024Product Sort and Display for WooCommerce: Unauthorized modification of dataCVE-2024-1807 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.
Product
Product Sort and Display for WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Product Sort and Display for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 2, 2024Sharkdropship for AliExpress Dropshipping and Affiliate: Unauthorized loss of dataCVE-2024-1732 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wads_removeProductFromShop() function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
Sharkdropship for AliExpress Dropshipping and Affiliate
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Sharkdropship for AliExpress Dropshipping and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2024Shortcodes and extra features for Phlox: Missing AuthorizationCVE-2024-31099 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme auxin-elements.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.7.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.15.7
What to do
Affects up to 2.15.7. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Thumbs Rating: Authorization Bypass Through User-Controlled KeyCVE-2024-31095 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0.
Product
Thumbs Rating
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Thumbs Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Whizzy: Authorization Bypass Through User-Controlled KeyCVE-2024-30543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
Product
Whizzy
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update Whizzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024BEAR: Missing AuthorizationCVE-2024-30463 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.
Product
BEAR
Affected
up to 1.1.4.3
What to do
Affects up to 1.1.4.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-30513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.
Product
ProfileGrid
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Klarna Payments for WooCommerce: Missing AuthorizationCVE-2024-30477 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.
Product
Klarna Payments for WooCommerce
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Klarna Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Wholesale For WooCommerce: Missing AuthorizationCVE-2024-30469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
Product
Wholesale For WooCommerce
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Wholesale For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WP Hotel Booking: Missing AuthorizationCVE-2024-30508 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.
Product
WP Hotel Booking
Affected
up to 2.0.9.2
What to do
Affects up to 2.0.9.2. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Molongui: Authorization Bypass Through User-Controlled KeyCVE-2024-30507 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
Product
Molongui
Affected
up to 4.7.7
What to do
Affects up to 4.7.7. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Church Admin: Missing AuthorizationCVE-2024-30505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.
Product
Church Admin
Affected
up to 4.1.18
What to do
Affects up to 4.1.18. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-30487 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 5.1
What to do
Affects up to 5.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Responsive: Unauthorized modification of dataCVE-2024-2848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer.
Product
Responsive
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024OceanWP: Unauthorized access of dataCVE-2024-2476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys.
Product
OceanWP
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update OceanWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024Easy Appointments: Unauthorized modification of dataCVE-2024-2844 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders.
Product
Easy Appointments
Affected
up to 3.11.18
What to do
Affects up to 3.11.18. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2024Booster Elite for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
Product
Booster Elite for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Elite for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Booster Plus for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Product
Booster Plus for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Plus for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Colibri Page Builder: Missing AuthorizationCVE-2024-28004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248.
Product
Colibri Page Builder
Affected
up to 1.0.248
What to do
Affects up to 1.0.248. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Max Mega Menu: Missing AuthorizationCVE-2024-28003 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3.
Product
Max Mega Menu
Affected
up to 3.3
What to do
Affects up to 3.3. Update Max Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Networker - Tech News WordPress Theme with Dark Mode: Unauthorized modification of dataCVE-2024-2962 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_reload_nav_menu() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to modify the location of display menus.
Product
Networker - Tech News WordPress Theme with Dark Mode
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Networker - Tech News WordPress Theme with Dark Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Mar 26, 2024Community by PeepSo: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-27630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.0.9.0.
Product
Community by PeepSo
Affected
up to 6.0.9.0
What to do
Affects up to 6.0.9.0. Update Community by PeepSo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Upload Resume: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25965 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0.
Product
Upload Resume
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Multiple Page Generator Plugin – MPG: Missing AuthorizationCVE-2024-30235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WholesaleX: Missing AuthorizationCVE-2024-30234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WholesaleX: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-30233 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Radio Player: Missing AuthorizationCVE-2024-2906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024SalesKing: Missing AuthorizationCVE-2024-22156 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15.
Product
SalesKing
Affected
up to 1.6.15
What to do
Affects up to 1.6.15. Update SalesKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Void Contact Form 7 Widget For Elementor Page Builder: Missing AuthorizationCVE-2023-52214 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.
Product
Void Contact Form 7 Widget For Elementor Page Builder
Affected
up to 2.3
What to do
Affects up to 2.3. Update Void Contact Form 7 Widget For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WooCommerce Box Office: Missing AuthorizationCVE-2024-24799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2.
Product
WooCommerce Box Office
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update WooCommerce Box Office to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Location Picker at Checkout for WooCommerce: Missing AuthorizationCVE-2024-24719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce: from n/a through 1.8.9.
Product
Location Picker at Checkout for WooCommerce
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update Location Picker at Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024PropertyHive: Missing AuthorizationCVE-2024-24718 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.6.
Product
PropertyHive
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WooCommerce Conversion Tracking: Missing AuthorizationCVE-2024-24711 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.
Product
WooCommerce Conversion Tracking
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update WooCommerce Conversion Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.