Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 16 of 30
Sep 17, 2024Accordion Image Menu: Does not have CSRF check in some placesCVE-2024-8092 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Accordion Image Menu
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Accordion Image Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Enhanced Search Box: Does not have CSRF check in placeCVE-2024-8091 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enhanced Search Box
- Affected
- up to 0.6.1
- What to do
- Affects up to 0.6.1. Update Enhanced Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Review Ratings: Does not have CSRF check in some placesCVE-2024-8052 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Review Ratings
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Review Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Special Feed Items: Does not have CSRF check in some placesCVE-2024-8051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Special Feed Items
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Special Feed Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Visual Sound (old): Does not have CSRF check in placeCVE-2024-8047 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound (old)
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Visual Sound (old) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024infolinks Ad Wrap: Does not have CSRF check in placeCVE-2024-8044 · WordPress plugins & themes · reported by WPScanMedium 6.5
The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- infolinks Ad Wrap
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update infolinks Ad Wrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Vikinghammer Tweet: Does not have CSRF check in some placesCVE-2024-8043 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Vikinghammer Tweet
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Vikinghammer Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Favicon Generator (CLOSED): Does not validate files to be uploaded and does not have CSRF checksCVE-2024-7863 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
- Product
- Favicon Generator (CLOSED)
- Fixed in
- 2.1
- What to do
- Update Favicon Generator (CLOSED) to 2.1 or newer.
Sep 12, 2024MM-Breaking News: Does not have CSRF check in some placesCVE-2024-8054 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- MM-Breaking News
- Affected
- up to 0.7.9
- What to do
- Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024blogintroduction-wordpress-plugin: Does not have CSRF check in placeCVE-2024-7862 · WordPress plugins & themes · reported by WPScanMedium 6.5
The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- blogintroduction-wordpress-plugin
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update blogintroduction-wordpress-plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Paypal: Does not have CSRF check in some placesCVE-2024-7861 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Paypal
- Affected
- up to 1.1.20090324
- What to do
- Affects up to 1.1.20090324. Update Misiek Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Simple Headline Rotator: Does not have CSRF check in some placesCVE-2024-7860 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Simple Headline Rotator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Headline Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Visual Sound: Does not have CSRF check in placeCVE-2024-7859 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update Visual Sound to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Quick Code: Does not have CSRF check in some placesCVE-2024-7822 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Quick Code
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Quick Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024ILC Thickbox: Does not have CSRF check in placeCVE-2024-7820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ILC Thickbox
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update ILC Thickbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF check in some placesCVE-2024-7818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF checks in some placesCVE-2024-7817 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Gixaw Chat: Does not have CSRF check in some placesCVE-2024-7816 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Gixaw Chat
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Gixaw Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Music Request Manager: Does not have CSRF check in some placesCVE-2024-6017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Easy Property Listings: Does not have CSRF checkCVE-2024-3163 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
Sep 9, 2024Snapshot Backup: Does not have CSRF check in some placesCVE-2024-7689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Snapshot Backup
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Snapshot Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF checks in some placesCVE-2024-7688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF check in some placesCVE-2024-7687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024TrueBooker: Does not have CSRF check in placeCVE-2024-6925 · WordPress plugins & themes · reported by WPScanMedium 4.3
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6856 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6855 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6852 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2024DN Popup: Does not have CSRF check in placeCVE-2024-7690 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Popup
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update DN Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Stripe Payments For WooCommerce by Checkout: Cross-Site Request Forgery (CSRF)CVE-2024-43316 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
- Product
- Stripe Payments For WooCommerce by Checkout
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024Stripe Payments For WooCommerce by Checkout: Authorization Bypass Through User-Controlled KeyCVE-2024-43315 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
- Product
- Stripe Payments For WooCommerce by Checkout
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2024The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability checCVE-2024-6500 · WordPress plugins & themes · reported by WordfenceCritical 10
The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read.
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2024wp-cart-for-digital-products: Does not have CSRF checks in some placesCVE-2024-6136 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.6
- What to do
- Update wp-cart-for-digital-products to 8.5.6 or newer.
Aug 6, 2024Light Poll: Does not have CSRF checks in some placesCVE-2024-6720 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5081 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-eMember
- Fixed in
- 10.7.0
- What to do
- Update wp-eMember to 10.7.0 or newer.
Aug 5, 2024The lacks CSRF checks allowing a user to invite any user to any group (including private groups)CVE-2024-2232 · WordPress plugins & themes · reported by WPScanHigh 8.1
The lacks CSRF checks allowing a user to invite any user to any group (including private groups)
- Fixed in
- 2.1.3
- What to do
- Update the plugin to 2.1.3 or newer.
Aug 1, 2024Light Poll: Does not have CSRF checksCVE-2024-6496 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such action via a CSRF attack
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some bulk actionsCVE-2024-3983 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some placesCVE-2024-2843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Jul 31, 2024HTML Forms: Does not have CSRF checks in some placesCVE-2024-6412 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- HTML Forms
- Fixed in
- 1.3.34
- What to do
- Update HTML Forms to 1.3.34 or newer.
Jul 30, 2024پلاگین پرداخت دلخواه: Does not have CSRF check in placeCVE-2024-6230 · WordPress plugins & themes · reported by WPScanMedium 6.5
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- پلاگین پرداخت دلخواه
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update پلاگین پرداخت دلخواه to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not have CSRF check in some placesCVE-2024-6224 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not have CSRF check in placeCVE-2024-5808 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5285 · WordPress plugins & themes · reported by WPScanMedium 5.5
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.2
- What to do
- Update wp-affiliate-platform to 6.5.2 or newer.
Jul 24, 2024The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPressCVE-2024-6836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to update multiple settings, including templates, designs, checkouts, and other plugin settings.
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2024WP EasyPay – Square for: Unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() functionCVE-2024-5861 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
- Product
- WP EasyPay – Square for
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WP EasyPay – Square for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2024Social Auto Poster: Unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ functionCVE-2024-6754 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.
- Product
- Social Auto Poster
- Affected
- up to 5.3.14
- What to do
- Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 22, 2024Community Events: Does not have CSRF check in placeCVE-2024-6271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack
- Product
- Community Events
- Fixed in
- 1.5
- What to do
- Update Community Events to 1.5 or newer.
Jul 22, 2024PZ Frontend Manager: Does not have CSRF checks in some placesCVE-2024-6244 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- PZ Frontend Manager
- Fixed in
- 1.0.6
- What to do
- Update PZ Frontend Manager to 1.0.6 or newer.
Jul 19, 2024ArtPlacer Widget: Does not have CSRF check in some placesCVE-2023-7269 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- ArtPlacer Widget
- Fixed in
- 2.21.2
- What to do
- Update ArtPlacer Widget to 2.21.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.