Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,165 results · page 134 of 204
Nov 1, 2024Uncanny Toolkit Pro for LearnDash: Missing AuthorizationCVE-2024-37439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0
- Product
- Uncanny Toolkit Pro for LearnDash
- What to do
- Update Uncanny Toolkit Pro for LearnDash to the newest version.
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-37427 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.
- Product
- Timetics
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Missing AuthorizationCVE-2024-37425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024e2pdf: Missing AuthorizationCVE-2024-37415 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
- Product
- e2pdf
- Affected
- up to 1.20.27
- What to do
- Affects up to 1.20.27. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Progress Planner: Missing AuthorizationCVE-2024-37411 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through <= 0.9.1.
- Product
- Progress Planner
- Affected
- up to 0.9.1
- What to do
- Affects up to 0.9.1. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Paid Memberships Pro: Authorization Bypass Through User-Controlled KeyCVE-2024-37277 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.
- Product
- Paid Memberships Pro
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.
- Product
- Featured Image from URL
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masterstudy Elementor Widgets: Missing AuthorizationCVE-2024-37269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ElementsKit Elementor addons Lite: Missing AuthorizationCVE-2024-37255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.1.4.
- Product
- ElementsKit Elementor addons Lite
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024File Manager: Missing AuthorizationCVE-2024-37254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.
- Product
- File Manager
- Affected
- up to 7.2.7
- What to do
- Affects up to 7.2.7. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37250 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
- Product
- Advanced Custom Fields PRO
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37249 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
- Product
- Advanced Custom Fields PRO
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Hercules Core: Missing AuthorizationCVE-2024-37232 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Hercules Design Hercules Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hercules Core: from n/a through 6.5.
- Product
- Hercules Core
- Affected
- up to 6.5
- What to do
- Affects up to 6.5. Update Hercules Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Kanban Boards for: Missing AuthorizationCVE-2024-37226 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
- Product
- Kanban Boards for
- Affected
- up to 2.5.21
- What to do
- Affects up to 2.5.21. Update Kanban Boards for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Optinly: Missing AuthorizationCVE-2024-37220 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OptinlyHQ Optinly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optinly: from n/a through 1.0.18.
- Product
- Optinly
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Optinly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Page Builder Sandwich – Front-End Page Builder: Missing AuthorizationCVE-2024-37218 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
- Product
- Page Builder Sandwich – Front-End Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ali2Woo Lite: Missing AuthorizationCVE-2024-37214 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
- Product
- Ali2Woo Lite
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ali2Woo Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Demo Awesome: Missing AuthorizationCVE-2024-37207 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2.
- Product
- Demo Awesome
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024PropertyHive: Missing AuthorizationCVE-2024-37204 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9.
- Product
- PropertyHive
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Laybuy Payment Extension for WooCommerce: Missing AuthorizationCVE-2024-37203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.
- Product
- Laybuy Payment Extension for WooCommerce
- Affected
- up to 5.3.9
- What to do
- Affects up to 5.3.9. Update Laybuy Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Woocommerce Customers Order History: Missing AuthorizationCVE-2024-37201 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2.
- Product
- Woocommerce Customers Order History
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update Woocommerce Customers Order History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ibtana: Missing AuthorizationCVE-2024-37123 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3.
- Product
- Ibtana
- Affected
- up to 1.2.3.3
- What to do
- Affects up to 1.2.3.3. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Uncanny Automator Pro: Missing AuthorizationCVE-2024-37119 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator Pro: from n/a through 5.3.0.0.
- Product
- Uncanny Automator Pro
- Affected
- up to 5.3.0.0
- What to do
- Affects up to 5.3.0.0. Update Uncanny Automator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Missing AuthorizationCVE-2024-37106 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Popup box: Missing AuthorizationCVE-2024-37096 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Popup Box Team Popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup box: from n/a through 4.5.1.
- Product
- Popup box
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-37095 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.7.3.
- Product
- Envira Photo Gallery
- Affected
- up to 1.8.7.3
- What to do
- Affects up to 1.8.7.3. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024MasterStudy LMS: Missing AuthorizationCVE-2024-37094 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
- Product
- MasterStudy LMS
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Multiple Page Generator Plugin – MPG: Unauthorized modification of and access to dataCVE-2024-7424 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.
- Product
- Multiple Page Generator Plugin – MPG
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2024Get Quote For Woocommerce – Request A Quote For Woocommerce: Unauthorized access of Quote dataCVE-2024-9430 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the ct_tepfw_wp_loaded function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to download Quote PDF and CSV documents.
- Product
- Get Quote For Woocommerce – Request A Quote For Woocommerce
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Get Quote For Woocommerce – Request A Quote For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 30, 2024Greenshift: Incorrect AuthorizationCVE-2024-50419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through <= 9.7.
- Product
- Greenshift
- Affected
- up to 9.7
- What to do
- Affects up to 9.7. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024User Toolkit: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3.
- Product
- User Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update User Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.
- Product
- Download Monitor
- Affected
- up to 5.0.13
- What to do
- Affects up to 5.0.13. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50454 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Multi Step Form: Missing AuthorizationCVE-2024-50428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.
- Product
- Multi Step Form
- Affected
- up to 1.7.21
- What to do
- Affects up to 1.7.21. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WP Booking System: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through <= 2.0.19.10.
- Product
- WP Booking System
- Affected
- up to 2.0.19.10
- What to do
- Affects up to 2.0.19.10. Update WP Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
- Product
- Templately
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
- Product
- Templately
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Breeze: Missing AuthorizationCVE-2024-50422 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
- Product
- Breeze
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2024-50421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 3.8.6.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50456 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50455 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Crypto: Authentication bypassCVE-2024-9989 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Crypto
- Affected
- up to 2.18
- What to do
- Affects up to 2.18. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024Crypto: Authentication bypassCVE-2024-9988 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Crypto
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024AidWP: Missing AuthorizationCVE-2024-50459 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AidWP: from n/a through <= 3.2.3.
- Product
- AidWP
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update AidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WPC Smart Messages for WooCommerce: Unauthorized Smar Message activation/deactivationCVE-2024-10437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.
- Product
- WPC Smart Messages for WooCommerce
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update WPC Smart Messages for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024PegaPoll: Missing AuthorizationCVE-2024-50490 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2.
- Product
- PegaPoll
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update PegaPoll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024GRÜN spendino Spendenformular: Missing AuthorizationCVE-2024-50476 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.
- Product
- GRÜN spendino Spendenformular
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update GRÜN spendino Spendenformular to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Signup Page: Missing AuthorizationCVE-2024-50475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.
- Product
- Signup Page
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Signup Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Unauthorized user profile modificationCVE-2024-10008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
- Product
- Masteriyo LMS – eLearning and Online Course Builder for
- Affected
- up to 1.13.3
- What to do
- Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 28, 2024Contact Form 7 + Telegram: Unauthorized modification of data and loss of dataCVE-2024-9629 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7_Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve, pause and refuse subscriptions.
- Product
- Contact Form 7 + Telegram
- Affected
- up to 0.8.5
- What to do
- Affects up to 0.8.5. Update Contact Form 7 + Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.