Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 19 of 30
Apr 15, 2024Simple Buttons Creator: Does not have CSRF checks in some placesCVE-2024-2858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Simple Buttons Creator
- Affected
- up to 1.04
- What to do
- Affects up to 1.04. Update Simple Buttons Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Advanced Search: Does not have CSRF checks in some placesCVE-2024-2739 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Advanced Search
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024NPS computy: Does not have CSRF checks in some placesCVE-2024-1755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Smart Forms: Does not have CSRF checks in some placesCVE-2024-1306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
- Product
- Smart Forms
- Fixed in
- 2.6.94
- What to do
- Update Smart Forms to 2.6.94 or newer.
Apr 12, 2024WooCommerce Checkout Field Editor (Checkout Manager): Cross-Site Request Forgery (CSRF)CVE-2024-31262 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Jcodex WooCommerce Checkout Field Editor (Checkout Manager).This issue affects WooCommerce Checkout Field Editor (Checkout Manager): from n/a through 2.1.8.
- Product
- WooCommerce Checkout Field Editor (Checkout Manager)
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update WooCommerce Checkout Field Editor (Checkout Manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024FunnelKit Checkout: Missing AuthorizationCVE-2023-51672 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
- Product
- FunnelKit Checkout
- Affected
- up to 3.10.3
- What to do
- Affects up to 3.10.3. Update FunnelKit Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024Ultimate Video Player For WordPress: Does not have proper capability checkCVE-2024-2428 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
- Product
- Ultimate Video Player For WordPress
- Fixed in
- 2.2.3
- What to do
- Update Ultimate Video Player For WordPress to 2.2.3 or newer.
Apr 10, 2024WordPress Ping Optimizer: Does not have CSRF checks in some placesCVE-2023-6385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs.
- Product
- WordPress Ping Optimizer
- Affected
- up to 2.35.1.3.0
- What to do
- Affects up to 2.35.1.3.0. Update WordPress Ping Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2024WooCommerce Cart Abandonment Recovery: Does not have CSRF check in its bulk actionsCVE-2024-2322 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
- Product
- WooCommerce Cart Abandonment Recovery
- Fixed in
- 1.2.27
- What to do
- Update WooCommerce Cart Abandonment Recovery to 1.2.27 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filtersCVE-2024-2262 · WordPress plugins & themes · reported by WPScanMedium 4.7
Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Mar 29, 2024Custom WooCommerce Checkout Fields Editor: Cross-Site Request Forgery (CSRF)CVE-2024-30518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
- Product
- Custom WooCommerce Checkout Fields Editor
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024Location Picker at Checkout for WooCommerce: Missing AuthorizationCVE-2024-24719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce: from n/a through 1.8.9.
- Product
- Location Picker at Checkout for WooCommerce
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Location Picker at Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 25, 2024Check & Log Email: Unauthenticated Hook InjectionCVE-2024-0866 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
- Product
- Check & Log Email
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Check & Log Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.1
- What to do
- Update CM Download Manager to 2.9.1 or newer.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1232 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.0
- What to do
- Update CM Download Manager to 2.9.0 or newer.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1231 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.0
- What to do
- Update CM Download Manager to 2.9.0 or newer.
Mar 22, 2024Custom WooCommerce Checkout Fields Editor: Stored Cross-Site ScriptingCVE-2024-1697 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options function in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Custom WooCommerce Checkout Fields Editor
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2024Appointment Booking Calendar: Does not have CSRF checks in some placesCVE-2024-0856 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.
- Product
- Appointment Booking Calendar
- Fixed in
- 1.3.83
- What to do
- Update Appointment Booking Calendar to 1.3.83 or newer.
Mar 18, 2024Innovs HR: Does not have CSRF checks in some placesCVE-2024-0858 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
- Product
- Innovs HR
- Fixed in
- 1.0.3.7.1
- What to do
- Update Innovs HR to 1.0.3.7.1 or newer.
Mar 15, 2024Broken Link Checker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25592 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.
- Product
- Broken Link Checker
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 29, 2024Restaurant Solutions – Checklist: Stored Cross-Site ScriptingCVE-2024-1977 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Restaurant Solutions – Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Restaurant Solutions – Checklist
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update Restaurant Solutions – Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwizlynxgroup.comwordfence.com
Feb 27, 2024Spiffy Calendar: Doesn't check the event_author parameterCVE-2024-0855 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
- Product
- Spiffy Calendar
- Fixed in
- 4.9.9
- What to do
- Update Spiffy Calendar to 4.9.9 or newer.
Feb 27, 2024Fatal Error Notify: Does not have authorisation and CSRF checks in its test_error AJAX actionCVE-2023-7202 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF
- Product
- Fatal Error Notify
- Fixed in
- 1.5.3
- What to do
- Update Fatal Error Notify to 1.5.3 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Feb 26, 2024WooCommerce Easy Checkout Field Editor, Fees & Discounts: Unrestricted Upload of File with Dangerous TypeCVE-2024-25925 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooCommerce Easy Checkout Field Editor, Fees & Discounts: from n/a through 3.5.12.
- Product
- WooCommerce Easy Checkout Field Editor, Fees & Discounts
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update WooCommerce Easy Checkout Field Editor, Fees & Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 12, 2024Splashscreen: Does not have CSRF check in placeCVE-2023-6501 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Splashscreen
- Affected
- up to 0.20
- What to do
- Affects up to 0.20. Update Splashscreen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Feb 12, 2024lasTunes: Does not have CSRF check in some placesCVE-2023-6499 · WordPress plugins & themes · reported by WPScanMedium 5.4
The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- lasTunes
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update lasTunes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024Web3: Is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'CVE-2023-6036 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Web3
- Fixed in
- 3.0.0
- What to do
- Update Web3 to 3.0.0 or newer.
Feb 8, 2024Woocommerce Vietnam Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24885 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lê Văn Toản Woocommerce Vietnam Checkout allows Stored XSS.This issue affects Woocommerce Vietnam Checkout: from n/a through 2.0.7.
- Product
- Woocommerce Vietnam Checkout
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Woocommerce Vietnam Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 5, 20243DPrint Lite: Does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX actionCVE-2021-4436 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
- Product
- 3DPrint Lite
- Fixed in
- 1.9.1.5
- What to do
- Update 3DPrint Lite to 1.9.1.5 or newer.
Feb 2, 2024Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on theCVE-2024-1047 · WordPress plugins & themes · reported by WordfenceMedium 5.3
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
- Affected
- up to 2.10.28
- What to do
- Affects up to 2.10.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 31, 2024WP Spell Check: Cross-Site Request Forgery (CSRF)CVE-2024-22143 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17.
- Product
- WP Spell Check
- Affected
- up to 9.17
- What to do
- Affects up to 9.17. Update WP Spell Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 29, 2024WP SOCIAL BOOKMARK MENU: Does not have CSRF check in placeCVE-2023-7074 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WP SOCIAL BOOKMARK MENU
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP SOCIAL BOOKMARK MENU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Autotitle for: Does not have CSRF check in placeCVE-2023-6946 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Autotitle for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Autotitle for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Site Notes: Does not have CSRF checks in some of its functionalitiesCVE-2023-6633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
- Product
- Site Notes
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Site Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024WP Plugin Lister: Does not have CSRF check in some placesCVE-2023-6503 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Plugin Lister
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Plugin Lister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Custom User CSS: Does not have CSRF check in placeCVE-2023-6391 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Custom User CSS
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Custom User CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024WordPress Users: Does not have CSRF check in placeCVE-2023-6390 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WordPress Users
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 22, 2024Product Enquiry for WooCommerce: Does not have a CSRF check in placeCVE-2023-6625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 22, 2024WP User Profile Avatar: Does not properly check for authorisationCVE-2023-6384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
- Product
- WP User Profile Avatar
- Fixed in
- 1.0.1
- What to do
- Update WP User Profile Avatar to 1.0.1 or newer.
Jan 16, 2024Community by PeepSo: Does not have CSRF checkCVE-2023-7125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack
- Product
- Community by PeepSo
- Fixed in
- 6.3.1.2
- What to do
- Update Community by PeepSo to 6.3.1.2 or newer.
Jan 16, 2024Voting Record: Does not have CSRF check in some placesCVE-2023-7083 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Voting Record
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Voting Record to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 16, 2024Ecwid Ecommerce Shopping Cart: Does not have CSRF check in placeCVE-2023-6292 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Ecwid Ecommerce Shopping Cart
- Fixed in
- 6.12.5
- What to do
- Update Ecwid Ecommerce Shopping Cart to 6.12.5 or newer.
Jan 16, 2024POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3178 · WordPress plugins & themes · reported by WPScanMedium 4.3
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.
- Product
- POST SMTP Mailer
- Fixed in
- 2.5.7
- What to do
- Update POST SMTP Mailer to 2.5.7 or newer.
Jan 16, 2024User registration & user profile: Does not have CSRF check in some placesCVE-2023-0824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
- Product
- User registration & user profile
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update User registration & user profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Contact Form & Lead Form Elementor Builder: Doesn't have authorisation and nonce checksCVE-2022-23180 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.7.4
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.7.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 16, 2024Core Control: Does not have CSRF check in placeCVE-2022-1760 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Core Control
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Core Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Coru LFMember: Does not have CSRF check in placeCVE-2022-1618 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in their settings, allowing attacker to make a logged in admin add an arbitrary game with XSS payloads
- Product
- Coru LFMember
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Coru LFMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024WP-Invoice: Does not have CSRF check in placeCVE-2022-1617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them
- Product
- WP-Invoice
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024School Management: Contains an obfuscated backdoor injected in it's license checking code that registers a REST API handlerCVE-2022-1609 · WordPress plugins & themes · reported by WPScanCritical 9.8
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
- Product
- School Management
- Fixed in
- 9.9.7
- What to do
- Update School Management to 9.9.7 or newer.
Jan 16, 2024WooCommerce: Does not have proper authorisation checkCVE-2022-0775 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment
- Product
- WooCommerce
- Fixed in
- 6.2.1
- What to do
- Update WooCommerce to 6.2.1 or newer.
Full record and what to do →NVD recorddeveloper.woocommerce.complugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.