Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

10,174 results · page 154 of 204

Apr 10, 2024Points and Rewards for WooCommerce: Missing AuthorizationCVE-2023-27607 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
Product
Points and Rewards for WooCommerce
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024AJAX Thumbnail Rebuild: Missing AuthorizationCVE-2022-47604 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13.
Product
AJAX Thumbnail Rebuild
Affected
up to 1.13
What to do
Affects up to 1.13. Update AJAX Thumbnail Rebuild to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024YITH WooCommerce Gift Cards Premium: Missing AuthorizationCVE-2022-44633 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.
Product
YITH WooCommerce Gift Cards Premium
Affected
up to 3.23.1
What to do
Affects up to 3.23.1. Update YITH WooCommerce Gift Cards Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Bricksforge: Missing AuthorizationCVE-2024-31242 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
Product
Bricksforge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024ShortPixel Adaptive Images: Missing AuthorizationCVE-2024-31230 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.2.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-31343 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WordPress Gallery Exporter: Missing AuthorizationCVE-2024-31342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPcloudgallery WordPress Gallery Exporter.This issue affects WordPress Gallery Exporter: from n/a through 1.3.
Product
WordPress Gallery Exporter
Affected
up to 1.3
What to do
Affects up to 1.3. Update WordPress Gallery Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 20245 Stars Rating Funnel: Missing AuthorizationCVE-2024-31358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.2.67.
Product
5 Stars Rating Funnel
Affected
up to 1.2.67
What to do
Affects up to 1.2.67. Update 5 Stars Rating Funnel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Contact Form Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-31302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.
Product
Contact Form Email
Affected
up to 1.3.44
What to do
Affects up to 1.3.44. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Wholesale For WooCommerce: Missing AuthorizationCVE-2024-31297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
Product
Wholesale For WooCommerce
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Wholesale For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024OAuth Server: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31253 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3.
Product
OAuth Server
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Radio – Worldwide Online Radio Stations Directory for: Unauthorized modification of dataCVE-2024-1042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with subscriber access and above, to import radio stations, remove countries, and modify the plugin's settings, which can lead to Cross-Site Scripting, tracked separately in CVE-2024-1041.
Product
WP Radio – Worldwide Online Radio Stations Directory for
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update WP Radio – Worldwide Online Radio Stations Directory for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 9, 2024Relevanssi – A Better Search: Unauthorized modification of dataCVE-2024-3213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the relevanssi_update_counts() function in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to execute expensive queries on the application that could lead into DOS.
Product
Relevanssi – A Better Search
Affected
up to 4.22.1
What to do
Affects up to 4.22.1. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WordPress Gallery Plugin – NextGEN Gallery: Unauthorized access of dataCVE-2024-3097 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
Product
WordPress Gallery Plugin – NextGEN Gallery
Affected
up to 3.59
What to do
Affects up to 3.59. Update WordPress Gallery Plugin – NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Permalink Manager Lite: Unauthorized access of dataCVE-2024-2543 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.
Product
Permalink Manager Lite
Affected
up to 2.4.3.1
What to do
Affects up to 2.4.3.1. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Apr 9, 2024Advanced Classifieds & Directory Pro: Unauthorized loss of dataCVE-2024-2222 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Graphene: Unauthorized access of dataCVE-2024-1984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source.
Product
Graphene
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Graphene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Apr 9, 2024WP Compress – Image Optimizer: Unauthorized modification of dataCVE-2024-1934 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images.
Product
WP Compress – Image Optimizer
Affected
up to 6.11.10
What to do
Affects up to 6.11.10. Update WP Compress – Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024MasterStudy LMS: Unauthorized access of dataCVE-2024-1904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
Product
MasterStudy LMS
Affected
up to 3.2.13
What to do
Affects up to 3.2.13. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024AI Post Generator | AutoWriter: Unauthorized access, modification or deletion of postsCVE-2024-1850 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin (even in non-published status), create new posts (and publish them), publish unpublished post or perform post deletions. CVE-2024-32713 may be a duplicate of this issue.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Accordion: Unauthorized access of data and modification of dataCVE-2024-1641 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts.
Product
Accordion
Affected
up to 2.2.96
What to do
Affects up to 2.2.96. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024360 Javascript Viewer: Unauthorized modification of dataCVE-2024-1637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings.
Product
360 Javascript Viewer
Affected
up to 1.7.12
What to do
Affects up to 1.7.12. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Happy Addons for Elementor: Unauthorized access of dataCVE-2024-1387 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.
Product
Happy Addons for Elementor
Affected
up to 3.10.4
What to do
Affects up to 3.10.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Unauthorized access & modification of dataCVE-2024-1352 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Cloak Affiliate Links: Unauthorized modification of dataCVE-2024-1308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.
Product
WooCommerce Cloak Affiliate Links
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update WooCommerce Cloak Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Clover Payment Gateway: Unauthorized modification of dataCVE-2024-0626 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark orders as paid.
Product
WooCommerce Clover Payment Gateway
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WooCommerce Clover Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Pods – Custom Content Types and Fields: Missing AuthorizationCVE-2023-6965 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This is due to the fact that the plugin allows the use of a file inclusion feature via shortcode. This makes it possible for authenticated attackers, with contributor access or higher, to create pods and users (with default role).
Product
Pods – Custom Content Types and Fields
Affected
up to 3.0.10
What to do
Affects up to 3.0.10. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WP Go Maps (formerly WP Google Maps): Unauthenticated API key disclosureCVE-2023-6777 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows unauthenticated attackers to make requests using this API key with the potential of exhausting requests resulting in an inability to use the map functionality offered by the plugin.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 9.0.34
What to do
Affects up to 9.0.34. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31368 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
Product
Soledad
Affected
up to 8.4.2
What to do
Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
Product
Soledad
Affected
up to 8.4.2
What to do
Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Post Type Builder (PTB): Missing AuthorizationCVE-2024-31366 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.
Product
Post Type Builder (PTB)
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Post Type Builder (PTB) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024WP2LEADS: Missing AuthorizationCVE-2024-31375 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads.This issue affects WP2LEADS: from n/a through <= 3.2.7.
Product
WP2LEADS
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024wpb-show-core: Does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated requestCVE-2024-1956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
Product
wpb-show-core
Fixed in
2.7
What to do
Update wpb-show-core to 2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 7, 2024BookingPress: Authorization Bypass Through User-Controlled KeyCVE-2024-31296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
Product
BookingPress
Affected
up to 1.0.81
What to do
Affects up to 1.0.81. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-31291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
Product
ProfileGrid
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized modification of dataCVE-2024-3216 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2024WP-Stateless – Google Cloud Storage: Unauthorized loss of dataCVE-2024-1385 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
Product
WP-Stateless – Google Cloud Storage
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update WP-Stateless – Google Cloud Storage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2024Image Watermark: Unauthorized modification of dataCVE-2024-1994 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() function in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to apply and remove watermarks from images.
Product
Image Watermark
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Image Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2024Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postingCVE-2023-35764 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting.
Fixed in
3.6.4
What to do
Update the plugin to 3.6.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 2, 2024Product Sort and Display for WooCommerce: Unauthorized modification of dataCVE-2024-1807 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.
Product
Product Sort and Display for WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Product Sort and Display for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 2, 2024Sharkdropship for AliExpress Dropshipping and Affiliate: Unauthorized loss of dataCVE-2024-1732 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wads_removeProductFromShop() function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
Sharkdropship for AliExpress Dropshipping and Affiliate
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Sharkdropship for AliExpress Dropshipping and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2024Shortcodes and extra features for Phlox: Missing AuthorizationCVE-2024-31099 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme auxin-elements.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.7.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.15.7
What to do
Affects up to 2.15.7. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Thumbs Rating: Authorization Bypass Through User-Controlled KeyCVE-2024-31095 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0.
Product
Thumbs Rating
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Thumbs Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Whizzy: Authorization Bypass Through User-Controlled KeyCVE-2024-30543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
Product
Whizzy
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update Whizzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024BEAR: Missing AuthorizationCVE-2024-30463 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.
Product
BEAR
Affected
up to 1.1.4.3
What to do
Affects up to 1.1.4.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-30513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.
Product
ProfileGrid
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Klarna Payments for WooCommerce: Missing AuthorizationCVE-2024-30477 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.
Product
Klarna Payments for WooCommerce
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Klarna Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Wholesale For WooCommerce: Missing AuthorizationCVE-2024-30469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
Product
Wholesale For WooCommerce
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Wholesale For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WP Hotel Booking: Missing AuthorizationCVE-2024-30508 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.
Product
WP Hotel Booking
Affected
up to 2.0.9.2
What to do
Affects up to 2.0.9.2. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Molongui: Authorization Bypass Through User-Controlled KeyCVE-2024-30507 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
Product
Molongui
Affected
up to 4.7.7
What to do
Affects up to 4.7.7. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.