Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

9,263 results · page 153 of 186

May 17, 2024WebinarIgnition: Improper Privilege ManagementCVE-2023-51424 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Saleswonder Team WebinarIgnition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through 3.05.0.
Product
WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for Beaver Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-51401 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Relative Path Traversal.This issue affects Ultimate Addons for Beaver Builder: from n/a through 1.35.13.
Product
Ultimate Addons for Beaver Builder
Affected
up to 1.35.13
What to do
Affects up to 1.35.13. Update Ultimate Addons for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for Beaver Builder: Improper Privilege ManagementCVE-2023-51398 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Privilege Escalation.This issue affects Ultimate Addons for Beaver Builder: from n/a through 1.35.14.
Product
Ultimate Addons for Beaver Builder
Affected
up to 1.35.14
What to do
Affects up to 1.35.14. Update Ultimate Addons for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ARMember: Improper Privilege ManagementCVE-2023-51356 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.
Product
ARMember
Affected
up to 4.0.10
What to do
Affects up to 4.0.10. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for Elementor: Improper Privilege ManagementCVE-2023-50890 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.20.
Product
Ultimate Addons for Elementor
Affected
up to 1.36.20
What to do
Affects up to 1.36.20. Update Ultimate Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Adifier System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-49753 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spoonthemes Adifier System allows PHP Local File Inclusion.This issue affects Adifier System: from n/a before 3.1.4.
Product
Adifier System
Fixed in
3.1.4
What to do
Update Adifier System to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JetEngine: Improper Privilege ManagementCVE-2023-48757 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4.
Product
JetEngine
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Salon booking system: Improper Privilege ManagementCVE-2023-48319 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6.
Product
Salon booking system
Affected
up to 8.6
What to do
Affects up to 8.6. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024wpForo Forum: Improper Privilege ManagementCVE-2023-47868 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.3.
Product
wpForo Forum
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Thrive Theme Builder: Improper Privilege ManagementCVE-2023-47782 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Thrive Themes Thrive Theme Builder allows Privilege Escalation.This issue affects Thrive Theme Builder: from n/a before 3.24.0.
Product
Thrive Theme Builder
Fixed in
3.24.0
What to do
Update Thrive Theme Builder to 3.24.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Improper Privilege ManagementCVE-2023-47683 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.
Product
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
Affected
up to 7.6.6
What to do
Affects up to 7.6.6. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WP User Frontend: Improper Privilege ManagementCVE-2023-47682 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in weDevs WP User Frontend allows Privilege Escalation.This issue affects WP User Frontend: from n/a through 3.6.5.
Product
WP User Frontend
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Qi Addons For Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-47679 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QODE Interactive Qi Addons For Elementor allows PHP Local File Inclusion.This issue affects Qi Addons For Elementor: from n/a through 1.6.3.
Product
Qi Addons For Elementor
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024The Plus Addons for Elementor Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-47178 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows PHP Local File Inclusion.This issue affects The Plus Addons for Elementor Pro: from n/a through 5.2.8.
Product
The Plus Addons for Elementor Pro
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update The Plus Addons for Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ICS Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF)CVE-2023-46784 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3.
Product
ICS Calendar
Affected
up to 10.12.0.3
What to do
Affects up to 10.12.0.3. Update ICS Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for WPBakery Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-46205 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows PHP Local File Inclusion.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.14.
Product
Ultimate Addons for WPBakery Page Builder
Affected
up to 3.19.14
What to do
Affects up to 3.19.14. Update Ultimate Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Popup by Supsystic: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-46197 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10.19.
Product
Popup by Supsystic
Affected
up to 1.10.19
What to do
Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Themify Ultra: Improper Privilege ManagementCVE-2023-46145 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Remote Content Shortcode: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-45652 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Justin Silver Remote Content Shortcode allows PHP Local File Inclusion.This issue affects Remote Content Shortcode: from n/a through 1.5.
Product
Remote Content Shortcode
Affected
up to 1.5
What to do
Affects up to 1.5. Update Remote Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Simple Membership: Improper Privilege ManagementCVE-2023-41957 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4.
Product
Simple Membership
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Simple Membership: Improper AuthenticationCVE-2023-41956 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.
Product
Simple Membership
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Essential Addons for Elementor: Improper Privilege ManagementCVE-2023-41955 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.
Product
Essential Addons for Elementor
Affected
up to 5.8.8
What to do
Affects up to 5.8.8. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ProfilePress: Improper Privilege ManagementCVE-2023-41954 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.
Product
ProfilePress
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024GiveWP: Improper Privilege ManagementCVE-2023-41665 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0.
Product
GiveWP
Affected
up to 2.33.0
What to do
Affects up to 2.33.0. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WPvivid Backup and Migration: Improper Privilege ManagementCVE-2023-41243 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in WPvivid Team WPvivid Backup and Migration allows Privilege Escalation.This issue affects WPvivid Backup and Migration: from n/a through 0.9.90.
Product
WPvivid Backup and Migration
Affected
up to 0.9.90
What to do
Affects up to 0.9.90. Update WPvivid Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Phlox Shop: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-39163 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.
Product
Phlox Shop
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Phlox Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Phlox Portfolio: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-38399 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1.
Product
Phlox Portfolio
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Phlox Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024HT Mega: Improper Privilege ManagementCVE-2023-37999 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.
Product
HT Mega
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update HT Mega to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Shortcodes and extra features for Phlox: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-37888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JetFormBuilder: Improper Privilege ManagementCVE-2023-37866 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.0.8.
Product
JetFormBuilder
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Booking Package: Improper Privilege ManagementCVE-2023-37389 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in SAASPROJECT Booking Package Booking Package allows Privilege Escalation.This issue affects Booking Package: from n/a through 1.5.98.
Product
Booking Package
Affected
up to 1.5.98
What to do
Affects up to 1.5.98. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Consulting: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-37385 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.5.6.
Product
Consulting
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WooCommerce One Page Checkout: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-35881 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.
Product
WooCommerce One Page Checkout
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WooCommerce One Page Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Unite Gallery Lite: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-33310 · WordPress plugins & themes · reported by PatchstackMedium 6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n/a through 1.7.59.
Product
Unite Gallery Lite
Affected
up to 1.7.59
What to do
Affects up to 1.7.59. Update Unite Gallery Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024LWS Affiliation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-32297 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6.
Product
LWS Affiliation
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update LWS Affiliation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Woodmart Core: Improper Privilege ManagementCVE-2023-32244 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in xtemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.
Product
Woodmart Core
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update Woodmart Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JupiterX: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-32110 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue affects JupiterX: from n/a through 3.0.0.
Product
JupiterX
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update JupiterX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Houzez: Improper Privilege ManagementCVE-2023-26540 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.
Product
Houzez
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Bookly: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-26526 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1.
Product
Bookly
Affected
up to 21.7.1
What to do
Affects up to 21.7.1. Update Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Houzez Login Register: Improper Privilege ManagementCVE-2023-26009 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3.
Product
Houzez Login Register
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Houzez Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WatchTowerHQ: Improper Privilege ManagementCVE-2023-25701 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.
Product
WatchTowerHQ
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update WatchTowerHQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Shortcodes Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-25050 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.
Product
Shortcodes Ultimate
Affected
up to 5.12.6
What to do
Affects up to 5.12.6. Update Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Landing Page Builder – Free Landing Page Templates: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/a through 3.1.9.9.
Product
Landing Page Builder – Free Landing Page Templates
Affected
up to 3.1.9.9
What to do
Affects up to 3.1.9.9. Update Landing Page Builder – Free Landing Page Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Redirection for Contact Form 7: Improper Privilege ManagementCVE-2023-23990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Privilege Management vulnerability in Qube One Ltd. Redirection for Contact Form 7 wpcf7-redirect allows Privilege Escalation.This issue affects Redirection for Contact Form 7: from n/a through 2.7.0.
Product
Redirection for Contact Form 7
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Rank Math SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rank Math Rank Math SEO allows Path Traversal.This issue affects Rank Math SEO: from n/a through 1.0.107.2.
Product
Rank Math SEO
Affected
up to 1.0.107.2
What to do
Affects up to 1.0.107.2. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024GMAce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23872 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in German Mesky GMAce allows Path Traversal.This issue affects GMAce: from n/a through 1.5.2.
Product
GMAce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update GMAce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024OceanWP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23700 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OceanWP allows PHP Local File Inclusion.This issue affects OceanWP: from n/a through 3.4.1.
Product
OceanWP
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update OceanWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024MainWP Code Snippets Extension: Improper Control of Generation of Code ('Code Injection')CVE-2023-23645 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in MainWP MainWP Code Snippets Extension allows Code Injection.This issue affects MainWP Code Snippets Extension: from n/a through 4.0.2.
Product
MainWP Code Snippets Extension
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update MainWP Code Snippets Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024YARPP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-45374 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YARPP allows PHP Local File Inclusion.This issue affects YARPP: from n/a through 5.30.4.
Product
YARPP
Affected
up to 5.30.4
What to do
Affects up to 5.30.4. Update YARPP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 20241003 Mortgage Application: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-45368 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Lenderd 1003 Mortgage Application allows Relative Path Traversal.This issue affects 1003 Mortgage Application: from n/a through 1.75.
Product
1003 Mortgage Application
Affected
up to 1.75
What to do
Affects up to 1.75. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.