Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

10,175 results · page 146 of 204

Jun 9, 2024Responsive Lightbox: Missing AuthorizationCVE-2024-31252 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6.
Product
Responsive Lightbox
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Responsive Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024All-in-One Video Gallery: Missing AuthorizationCVE-2024-31248 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Plugins360 All-in-One Video Gallery.This issue affects All-in-One Video Gallery: from n/a through 3.5.2.
Product
All-in-One Video Gallery
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Bricksforge: Missing AuthorizationCVE-2024-31244 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
Product
Bricksforge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Bricksforge: Missing AuthorizationCVE-2024-31243 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
Product
Bricksforge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Whizzy: Missing AuthorizationCVE-2024-30544 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in UPQODE Whizzy.This issue affects Whizzy: from n/a through 1.1.18.
Product
Whizzy
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update Whizzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Tainacan: Missing AuthorizationCVE-2024-30529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.7.
Product
Tainacan
Affected
up to 0.20.7
What to do
Affects up to 0.20.7. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Sliced Invoices: Missing AuthorizationCVE-2024-30517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2.
Product
Sliced Invoices
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Sliced Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Events Manager: Missing AuthorizationCVE-2024-30515 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4.
Product
Events Manager
Affected
up to 6.4.6.4
What to do
Affects up to 6.4.6.4. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024weForms: Missing AuthorizationCVE-2024-30512 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.
Product
weForms
Affected
up to 1.6.20
What to do
Affects up to 1.6.20. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Finale Lite: Missing AuthorizationCVE-2024-30485 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.
Product
Finale Lite
Affected
up to 2.18.0
What to do
Affects up to 2.18.0. Update Finale Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024YITH WooCommerce Account Funds Premium: Missing AuthorizationCVE-2024-30470 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.
Product
YITH WooCommerce Account Funds Premium
Affected
up to 1.33.0
What to do
Affects up to 1.33.0. Update YITH WooCommerce Account Funds Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Essential Blocks for Gutenberg: Missing AuthorizationCVE-2024-30467 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg.This issue affects Essential Blocks for Gutenberg: from n/a through 4.4.9.
Product
Essential Blocks for Gutenberg
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WooCommerce Multilingual & Multicurrency: Missing AuthorizationCVE-2024-30466 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.4.
Product
WooCommerce Multilingual & Multicurrency
Affected
up to 5.3.4
What to do
Affects up to 5.3.4. Update WooCommerce Multilingual & Multicurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024PageLayer: Missing AuthorizationCVE-2024-30465 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.
Product
PageLayer
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Social Icons Widget & Block by WPZOOM: Missing AuthorizationCVE-2024-30464 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.
Product
Social Icons Widget & Block by WPZOOM
Affected
up to 4.2.15
What to do
Affects up to 4.2.15. Update Social Icons Widget & Block by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2024-25929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.5.
Product
Product Catalog Enquiry for WooCommerce by MultiVendorX
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024NextMove Lite: Missing AuthorizationCVE-2024-25092 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.
Product
NextMove Lite
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Awesome Support: Missing AuthorizationCVE-2024-24716 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.6.
Product
Awesome Support
Affected
up to 6.1.6
What to do
Affects up to 6.1.6. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WooCommerce Box Office: Missing AuthorizationCVE-2023-34003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.
Product
WooCommerce Box Office
Affected
up to 1.1.51
What to do
Affects up to 1.1.51. Update WooCommerce Box Office to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2023-31080 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024MainWP UpdraftPlus Extension: Missing AuthorizationCVE-2023-23640 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.
Product
MainWP UpdraftPlus Extension
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update MainWP UpdraftPlus Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024MainWP Staging Extension: Missing AuthorizationCVE-2023-23639 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3.
Product
MainWP Staging Extension
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update MainWP Staging Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WP Sort Order: Missing AuthorizationCVE-2024-31294 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fahad Mahmood WP Sort Order.This issue affects WP Sort Order: from n/a through 1.3.1.
Product
WP Sort Order
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP Sort Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024PostX: Missing AuthorizationCVE-2024-31246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.
Product
PostX
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024New Order Notification for Woocommerce: Missing AuthorizationCVE-2024-31098 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Mr.Ebabi New Order Notification for Woocommerce.This issue affects New Order Notification for Woocommerce: from n/a through 2.0.2.
Product
New Order Notification for Woocommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update New Order Notification for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Awesome Support: Missing AuthorizationCVE-2024-30539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
Product
Awesome Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024DELUCKS SEO: Missing AuthorizationCVE-2024-30538 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS GmbH DELUCKS SEO.This issue affects DELUCKS SEO: from n/a through 2.5.4.
Product
DELUCKS SEO
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WPC Badge Management for WooCommerce: Missing AuthorizationCVE-2024-30537 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.
Product
WPC Badge Management for WooCommerce
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update WPC Badge Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Calendarista Basic Edition: Missing AuthorizationCVE-2024-30534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.
Product
Calendarista Basic Edition
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Booster Plus for WooCommerce: Missing AuthorizationCVE-2023-52232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
Product
Booster Plus for WooCommerce
Fixed in
7.1.2
What to do
Update Booster Plus for WooCommerce to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Booster Plus for WooCommerce: Missing AuthorizationCVE-2023-52230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.
Product
Booster Plus for WooCommerce
Fixed in
7.1.3
What to do
Update Booster Plus for WooCommerce to 7.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WooCommerce Product Vendors: Missing AuthorizationCVE-2023-51494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.
Product
WooCommerce Product Vendors
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WooCommerce Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Import and export users and customers: Missing AuthorizationCVE-2024-22151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
Product
Import and export users and customers
Affected
up to 1.24.6
What to do
Affects up to 1.24.6. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Icegram: Missing AuthorizationCVE-2024-21748 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.
Product
Icegram
Affected
up to 3.1.21
What to do
Affects up to 3.1.21. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024KiviCare: Missing AuthorizationCVE-2024-35659 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.
Product
KiviCare
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Widget Options - Extended: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35691 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.
Product
Widget Options - Extended
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Widget Options - Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Otter Blocks PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.
Product
Otter Blocks PRO
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Otter Blocks PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Podlove Web Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35710 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3.
Product
Podlove Web Player
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024CF7 Google Sheets Connector: Unauthorized modification of dataCVE-2024-5654 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.
Product
CF7 Google Sheets Connector
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 8, 2024Salon booking system: Unauthorized access and modification of dataCVE-2024-4468 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.
Product
Salon booking system
Affected
up to 9.9
What to do
Affects up to 9.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 8, 2024Minimal Coming Soon – Coming Soon Page: Unauthorized modification of dataCVE-2024-5087 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.
Product
Minimal Coming Soon – Coming Soon Page
Affected
up to 2.38
What to do
Affects up to 2.38. Update Minimal Coming Soon – Coming Soon Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 8, 2024WP Reset: Unauthorized modification of dataCVE-2024-4661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.
Product
WP Reset
Affected
up to 2.02
What to do
Affects up to 2.02. Update WP Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 8, 2024WP Force SSL & HTTPS SSL Redirect: Unauthorized modification of dataCVE-2024-5770 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
Product
WP Force SSL & HTTPS SSL Redirect
Affected
up to 1.66
What to do
Affects up to 1.66. Update WP Force SSL & HTTPS SSL Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Unauthorized modification of dataCVE-2024-5382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
Product
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Affected
up to 2.0.6.1
What to do
Affects up to 2.0.6.1. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2024Market Exporter: Unauthorized loss of dataCVE-2024-5637 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server.
Product
Market Exporter
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024ARForms - Premium WordPress Form Builder: Allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploadedCVE-2024-4620 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.6
What to do
Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2024Strong Testimonials: Unauthorized modification of dataCVE-2023-6491 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.
Product
Strong Testimonials
Affected
up to 3.1.12
What to do
Affects up to 3.1.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024GDPR CCPA Compliance & Cookie Consent Banner: Unauthorized modification of dataCVE-2024-5607 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts.
Product
GDPR CCPA Compliance & Cookie Consent Banner
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update GDPR CCPA Compliance & Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024WooCommerce Tools: Unauthorized modification of dataCVE-2024-1689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.
Product
WooCommerce Tools
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WooCommerce Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Clever Fox – One Click Website Importer by Nayra: Unauthorized modification of dataCVE-2023-6876 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site.
Product
Clever Fox – One Click Website Importer by Nayra
Affected
up to 25.2.0
What to do
Affects up to 25.2.0. Update Clever Fox – One Click Website Importer by Nayra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.