Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 21 of 30
Jul 17, 2023Caldera Forms Google Sheets Connector: Does not have CSRF checkCVE-2023-2330 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- Caldera Forms Google Sheets Connector
- Fixed in
- 1.3
- What to do
- Update Caldera Forms Google Sheets Connector to 1.3 or newer.
Jul 17, 2023WooCommerce Google Sheet Connector: Does not have CSRF checkCVE-2023-2329 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- WooCommerce Google Sheet Connector
- Fixed in
- 1.3.6
- What to do
- Update WooCommerce Google Sheet Connector to 1.3.6 or newer.
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.CVE-2023-24421 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.
- Fixed in
- 1.6.0
- What to do
- Update the plugin to 1.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3209 · WordPress plugins & themes · reported by WPScanLow 3.5
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- Product
- MStore API
- Fixed in
- 3.9.7
- What to do
- Update MStore API to 3.9.7 or newer.
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3131 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- Product
- MStore API
- Fixed in
- 3.9.7
- What to do
- Update MStore API to 3.9.7 or newer.
Jul 10, 2023Greeklish-permalink: Does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX actionCVE-2023-2495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
- Product
- Greeklish-permalink
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Greeklish-permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2023Tutor LMS: Does not implement adequate permission checks for REST API endpointsCVE-2023-3133 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
- Product
- Tutor LMS
- Fixed in
- 2.2.1
- What to do
- Update Tutor LMS to 2.2.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 4, 2023Forminator: Does not use an atomic operation to check whether a user has already votedCVE-2023-2010 · WordPress plugins & themes · reported by WPScanLow 3.1
The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.
- Product
- Forminator
- Fixed in
- 1.24.1
- What to do
- Update Forminator to 1.24.1 or newer.
Jul 1, 2023WooCommerce Checkout & Funnel Builder by CartFlows: Cross-Site Request ForgeryCVE-2020-36736 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the export_json, import_json, and status_logs_file functions. This makes it possible for unauthenticated attackers to import/export settings and trigger logs showing via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WooCommerce Checkout & Funnel Builder by CartFlows
- Affected
- up to 1.5.15
- What to do
- Affects up to 1.5.15. Update WooCommerce Checkout & Funnel Builder by CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 27, 2023WP Inventory Manager: Does not have CSRF checksCVE-2023-2842 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack
- Product
- WP Inventory Manager
- Fixed in
- 2.1.0.14
- What to do
- Update WP Inventory Manager to 2.1.0.14 or newer.
Jun 27, 2023KiviCare: Does not have CSRF checks (either flawed or missing completely) in various AJAX actionsCVE-2023-2628 · WordPress plugins & themes · reported by WPScanHigh 8.8
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Jun 27, 2023KiviCare: Does not have proper CSRF and authorisation checks in various AJAX actionsCVE-2023-2627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Jun 27, 2023Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro: Does not have CSRF checkCVE-2023-2326 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro
- Affected
- up to 1.3.5
- Fixed in
- 1.3.5
- What to do
- Update Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro to 1.3.5 or newer.
Jun 19, 2023Slider Revolution: Does not check for valid image files upon importCVE-2023-2359 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
- Product
- Slider Revolution
- Affected
- up to 6.6.12
- What to do
- Affects up to 6.6.12. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2023Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory fuCVE-2021-4337 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Flexible Checkout Fields for WooCommerce: Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site ScriptingCVE-2020-36731 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
- Product
- Flexible Checkout Fields for WooCommerce
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Flexible Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 4, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress.CVE-2014-125105 · WordPress plugins & themes · reported by VulDBLow 2.4
A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
- Product
- Broken Link Checker
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023WP Fastest Cache: Does not have CSRF check in an AJAX actionCVE-2023-1938 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue
- Product
- WP Fastest Cache
- Fixed in
- 1.1.5
- What to do
- Update WP Fastest Cache to 1.1.5 or newer.
May 30, 2023Newsletter Popup: Does not have CSRF checks in some placesCVE-2023-0766 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.CVE-2022-47161 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0763 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0761 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Sloth Logo Customizer: Does not have CSRF checkCVE-2023-0603 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Sloth Logo Customizer
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Sloth Logo Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Enable/Disable Auto Login when Register: Does not have CSRF check in placeCVE-2023-0522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enable/Disable Auto Login when Register
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Enable/Disable Auto Login when Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023MyCryptoCheckout: Does not escape some URLs before outputting them in attributesCVE-2023-1546 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
- Product
- MyCryptoCheckout
- Fixed in
- 2.124
- What to do
- Update MyCryptoCheckout to 2.124 or newer.
Apr 24, 2023Custom Post Type UI: Does not properly check for CSRFCVE-2023-1623 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.
- Product
- Custom Post Type UI
- Fixed in
- 1.13.5
- What to do
- Update Custom Post Type UI to 1.13.5 or newer.
Apr 24, 2023WP VR: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2023-1414 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
- Product
- WP VR
- Fixed in
- 8.3.0
- What to do
- Update WP VR to 8.3.0 or newer.
Apr 17, 2023Redirection: Does not have CSRF checks in the uninstall actionCVE-2023-1331 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.
- Product
- Redirection
- Fixed in
- 1.1.5
- What to do
- Update Redirection to 1.1.5 or newer.
Apr 17, 2023Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updCVE-2023-0889 · WordPress plugins & themes · reported by WPScanMedium 6.5
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 8, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress.CVE-2015-10098 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
- Product
- Broken Link Checker
- Affected
- up to 1.10.5
- What to do
- Affects up to 1.10.5. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023OAuth Single Sign On: Does not have CSRF checksCVE-2023-1093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
- Product
- OAuth Single Sign On
- Fixed in
- 6.24.2
- What to do
- Update OAuth Single Sign On to 6.24.2 or newer.
Mar 27, 2023Coupon Zen: Does not have CSRF checkCVE-2023-1089 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Coupon Zen
- Fixed in
- 1.0.6
- What to do
- Update Coupon Zen to 1.0.6 or newer.
Mar 27, 2023WP Plugin Manager: Does not have CSRF checkCVE-2023-1088 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Plugin Manager
- Fixed in
- 1.1.8
- What to do
- Update WP Plugin Manager to 1.1.8 or newer.
Mar 27, 2023WC Sales Notification: Does not have CSRF checkCVE-2023-1087 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WC Sales Notification
- Fixed in
- 1.2.3
- What to do
- Update WC Sales Notification to 1.2.3 or newer.
Mar 27, 2023Preview Link Generator: Does not have CSRF checkCVE-2023-1086 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Preview Link Generator
- Fixed in
- 1.0.4
- What to do
- Update Preview Link Generator to 1.0.4 or newer.
Mar 27, 2023Ever Compare: Does not have CSRF checkCVE-2023-0505 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Ever Compare
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Ever Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023HT Politic: Does not have CSRF checkCVE-2023-0504 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Politic
- Fixed in
- 2.3.8
- What to do
- Update HT Politic to 2.3.8 or newer.
Mar 27, 2023Free WooCommerce Theme 99fy Extension: Does not have CSRF checkCVE-2023-0503 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Free WooCommerce Theme 99fy Extension
- Fixed in
- 1.2.8
- What to do
- Update Free WooCommerce Theme 99fy Extension to 1.2.8 or newer.
Mar 27, 2023WP News: Does not have CSRF checkCVE-2023-0502 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP News
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update WP News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023WP Insurance: Does not have CSRF checkCVE-2023-0501 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Insurance
- Fixed in
- 2.1.4
- What to do
- Update WP Insurance to 2.1.4 or newer.
Mar 27, 2023WP Film Studio: Does not have CSRF checkCVE-2023-0500 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Film Studio
- Fixed in
- 1.3.5
- What to do
- Update WP Film Studio to 1.3.5 or newer.
Mar 27, 2023QuickSwish: Does not have CSRF checkCVE-2023-0499 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- QuickSwish
- Fixed in
- 1.1.0
- What to do
- Update QuickSwish to 1.1.0 or newer.
Mar 27, 2023WP Education: Does not have CSRF checkCVE-2023-0498 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Education
- Fixed in
- 1.2.7
- What to do
- Update WP Education to 1.2.7 or newer.
Mar 27, 2023HT Portfolio: Does not have CSRF checkCVE-2023-0497 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Portfolio
- Fixed in
- 1.1.6
- What to do
- Update HT Portfolio to 1.1.6 or newer.
Mar 27, 2023HT Event: Does not have CSRF checkCVE-2023-0496 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Event
- Fixed in
- 1.4.6
- What to do
- Update HT Event to 1.4.6 or newer.
Mar 27, 2023HT Slider For Elementor: Does not have CSRF checkCVE-2023-0495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Slider For Elementor
- Fixed in
- 1.4.0
- What to do
- Update HT Slider For Elementor to 1.4.0 or newer.
Mar 27, 2023Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks: Does not have CSRF checkCVE-2023-0484 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Fixed in
- 1.1.6
- What to do
- Update Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks to 1.1.6 or newer.
Mar 20, 2023WP OAuth Server (OAuth Authentication): Has a flawed CSRF and authorisation checkCVE-2022-4148 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.3.0
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.3.0 or newer.
Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.5
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.