Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

341new WordPress flaws this week

393,150entries in the database

10,175 results · page 152 of 204

Apr 29, 2024Pathway: Missing AuthorizationCVE-2024-33686 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.
Product
Pathway
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Pathway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Crelly Slider: Authorization Bypass Through User-Controlled KeyCVE-2024-33542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5.
Product
Crelly Slider
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Crelly Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requCVE-2024-2505 · WordPress plugins & themes · reported by WPScanHigh 8.1
The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress WordPress plugin before 6.8.9 configurations.
Fixed in
6.8.9
What to do
Update the plugin to 6.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Post Slider: Missing AuthorizationCVE-2022-40975 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7.
Product
Post Slider
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Reviews Plus: Missing AuthorizationCVE-2024-32822 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in impleCode Reviews Plus.This issue affects Reviews Plus: from n/a through 1.3.4.
Product
Reviews Plus
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Reviews Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Page Builder: Live Composer: Missing AuthorizationCVE-2024-32957 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38.
Product
Page Builder: Live Composer
Affected
up to 1.5.38
What to do
Affects up to 1.5.38. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-32829 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.31
What to do
Affects up to 1.10.31. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Flexible Shipping: Missing AuthorizationCVE-2024-32828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.
Product
Flexible Shipping
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update Flexible Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024VK Block Patterns: Missing AuthorizationCVE-2024-32826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.
Product
VK Block Patterns
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update VK Block Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Google Analytics by Monster Insights: Missing AuthorizationCVE-2023-52220 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MonsterInsights Google Analytics by Monster Insights.This issue affects Google Analytics by Monster Insights: from n/a through 8.21.0.
Product
Google Analytics by Monster Insights
Affected
up to 8.21.0
What to do
Affects up to 8.21.0. Update Google Analytics by Monster Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024WP Setup Wizard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25917 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodeRevolution WP Setup Wizard.This issue affects WP Setup Wizard: from n/a through 1.0.8.1.
Product
WP Setup Wizard
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WP Setup Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Login as User or Customer (User Switching): Improper AuthenticationCVE-2023-51484 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.
Product
Login as User or Customer (User Switching)
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login as User or Customer (User Switching) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Eazy Plugin Manager: Improper AuthenticationCVE-2023-51482 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eazy Plugin Manager: from n/a through 4.1.2.
Product
Eazy Plugin Manager
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Eazy Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Classified Listing – Classified ads & Business Directory: Unauthorized loss of dataCVE-2024-3893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.10.3
What to do
Affects up to 3.0.10.3. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024Build App Online: Improper AuthenticationCVE-2023-51478 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.
Product
Build App Online
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024BuddyBoss: Improper AuthenticationCVE-2023-51477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyBoss Theme: from n/a through 2.4.60.
Product
BuddyBoss
Affected
up to 2.4.60
What to do
Affects up to 2.4.60. Update BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Checkout Mestres WP: Improper AuthenticationCVE-2023-51472 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through 7.1.9.7.
Product
Checkout Mestres WP
Affected
up to 7.1.9.7
What to do
Affects up to 7.1.9.7. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Checkout Mestres WP: Improper AuthenticationCVE-2023-51471 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Checkout Mestres WP: from n/a through 7.1.9.7.
Product
Checkout Mestres WP
Affected
up to 7.1.9.7
What to do
Affects up to 7.1.9.7. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024TrackShip for WooCommerce: Missing AuthorizationCVE-2024-32678 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TrackShip TrackShip for WooCommerce.This issue affects TrackShip for WooCommerce: from n/a through 1.7.5.
Product
TrackShip for WooCommerce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update TrackShip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024LoginPress Pro: Missing AuthorizationCVE-2024-32677 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Order Limit for WooCommerce: Missing AuthorizationCVE-2024-32675 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Xfinity Soft Order Limit for WooCommerce.This issue affects Order Limit for WooCommerce: from n/a through 2.0.0.
Product
Order Limit for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Order Limit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Ovic Addon Toolkit: Missing AuthorizationCVE-2024-32432 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ovic Team Ovic Addon Toolkit.This issue affects Ovic Addon Toolkit: from n/a through 2.6.1.
Product
Ovic Addon Toolkit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Ovic Addon Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024BookingPress: Improper AuthenticationCVE-2023-51405 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BookingPress: from n/a through 1.0.74.
Product
BookingPress
Affected
up to 1.0.74
What to do
Affects up to 1.0.74. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Elementor Website Builder: Improper AuthenticationCVE-2023-47504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elementor Website Builder: from n/a through 3.16.4.
Product
Elementor Website Builder
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Multi Rating: Missing AuthorizationCVE-2023-32127 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Daniel Powney Multi Rating allows Functionality Misuse.This issue affects Multi Rating: from n/a through 5.0.6.
Product
Multi Rating
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Multi Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WoodMart: Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-25790 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.
Product
WoodMart
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WP Post Rating: Missing AuthorizationCVE-2023-25785 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5.
Product
WP Post Rating
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Post Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Rate my Post – WP Rating System: Authorization Bypass Through User-Controlled KeyCVE-2024-32823 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4.
Product
Rate my Post – WP Rating System
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-32808 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
Product
ProfileGrid
Affected
up to 5.7.9
What to do
Affects up to 5.7.9. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-32772 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
Product
ProfileGrid
Affected
up to 5.7.9
What to do
Affects up to 5.7.9. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Quiz Maker: Missing AuthorizationCVE-2023-23985 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
Product
Quiz Maker
Affected
up to 6.3.9.4
What to do
Affects up to 6.3.9.4. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Post Grid: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32816 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.
Product
Post Grid
Affected
up to 2.2.78
What to do
Affects up to 2.2.78. Update Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Email Customizer for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32781 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0.
Product
Email Customizer for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024VikRentCar: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32780 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in E4J s.R.L. VikRentCar.This issue affects VikRentCar: from n/a through 1.3.2.
Product
VikRentCar
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update VikRentCar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Frontend Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32726 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2.
Product
Frontend Dashboard
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024StreamWeasels Twitch Integration: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StreamWeasels StreamWeasels Twitch Integration.This issue affects StreamWeasels Twitch Integration: from n/a through 1.7.8.
Product
StreamWeasels Twitch Integration
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update StreamWeasels Twitch Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Max Addons Pro for Bricks: Missing AuthorizationCVE-2024-32951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BloomPixel Max Addons Pro for Bricks.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1.
Product
Max Addons Pro for Bricks
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Max Addons Pro for Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024ARMember: Missing AuthorizationCVE-2024-32948 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.
Product
ARMember
Affected
up to 4.0.28
What to do
Affects up to 4.0.28. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in an AJAX actionCVE-2024-1756 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name
Product
WooCommerce Customers Manager
Fixed in
29.8
What to do
Update WooCommerce Customers Manager to 29.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 23, 2024Shared Files: Missing AuthorizationCVE-2024-32679 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.
Product
Shared Files
Affected
up to 1.7.16
What to do
Affects up to 1.7.16. Update Shared Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2024Quick Featured Images: Unauthorized modification of dataCVE-2024-3664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
Product
Quick Featured Images
Affected
up to 13.7.0
What to do
Affects up to 13.7.0. Update Quick Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 22, 2024Active Products Tables for WooCommerce: Missing AuthorizationCVE-2024-32691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in realmag777 Active Products Tables for WooCommerce.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.2.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.6.2
What to do
Affects up to 1.0.6.2. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024MyRewards: Missing AuthorizationCVE-2024-32688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Long Watch Studio MyRewards.This issue affects MyRewards: from n/a through 5.3.0.
Product
MyRewards
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update MyRewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024WPC Frequently Bought Together for WooCommerce: Missing AuthorizationCVE-2024-32687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.0.3.
Product
WPC Frequently Bought Together for WooCommerce
Affected
up to 7.0.3
What to do
Affects up to 7.0.3. Update WPC Frequently Bought Together for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Wp Ultimate Review: Missing AuthorizationCVE-2024-32684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-32682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-32681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 19, 2024Wp Ultimate Review: Authorization Bypass Through User-Controlled KeyCVE-2024-32683 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WP Social Comments: Missing AuthorizationCVE-2024-32689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GenialSouls WP Social Comments.This issue affects WP Social Comments: from n/a through 1.7.3.
Product
WP Social Comments
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update WP Social Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.