Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

460new WordPress flaws this week

394,717entries in the database

17,729 results · page 231 of 355

Mar 1, 2024A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interruptingCVE-2024-22182 · Other software · Commend · reported by ics-cert@hq.dhs.govHigh 8.6
A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interrupting service.
Product
WS203VICM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record clibrary-online.commend.com cisa.gov
Mar 1, 2024** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker tCVE-2024-27139 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Product
Apache Archiva
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Feb 29, 2024IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoCVE-2023-28949 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216.
Product
Engineering Requirements Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 29, 2024A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual poCVE-2024-1949 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.6
A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Feb 29, 2024Migration, Backup, Staging – WPvivid: Unauthorized accessCVE-2024-1982 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progress() and restore() functions in all versions up to, and including, 0.9.68. This makes it possible for unauthenticated attackers to exploit a SQL injection vulnerability or trigger a DoS.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.68
What to do
Affects up to 0.9.68. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.hisolutions.com
Feb 28, 2024F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in CVE-2024-25833 · Other software · f-logic · reported by MITRECritical 9.8
F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database.
Product
datacube3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record neroteam.com neroteam.com
Feb 28, 2024A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause aCVE-2024-20321 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because eBGP traffic is mapped to a shared hardware rate-limiter queue. An attacker could exploit this vulnerability by sending large amounts of network traffic with certain characteristics through an affected device. A successful exploit could allow the attacker to cause eBGP neighbor sessions to be dropped, leading to a DoS condition in the network.
Product
Cisco NX-OS Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 28, 2024A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attCVE-2024-20294 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.6
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device and having an authenticated user retrieve LLDP statistics from the affected device through CLI show commands or Simple Network Management Protocol (SNMP) requests. A successful exploit could allow the attacker to cause the LLDP service to crash and stop running on the affected device. In certain situations, the LLDP crash may result in a reload of the affected device. Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).
Product
Cisco NX-OS Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 28, 2024A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to unexCVE-2024-20267 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to unexpectedly restart, which could cause the device to stop processing network traffic or to reload. This vulnerability is due to lack of proper error checking when processing an ingress MPLS frame. An attacker could exploit this vulnerability by sending a crafted IPv6 packet that is encapsulated within an MPLS frame to an MPLS-enabled interface of the targeted device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition. Note: The IPv6 packet can be generated multiple hops away from the targeted device and then encapsulated within MPLS. The DoS condition may occur when the NX-OS device processes the packet.
Product
Cisco NX-OS Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 28, 2024WPify Woo Czech: Unauthorized access of dataCVE-2024-1492 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.
Product
WPify Woo Czech
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update WPify Woo Czech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Login Lockdown – Protect Login Form: Unauthorized access of dataCVE-2024-1340 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
Product
Login Lockdown – Protect Login Form
Affected
up to 2.08
What to do
Affects up to 2.08. Update Login Lockdown – Protect Login Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024SKT Page Builder: Unauthorized modification of dataCVE-2024-1337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData' function in all versions up to, and including, 4.1. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary content into pages.
Product
SKT Page Builder
Affected
up to 4.1
What to do
Affects up to 4.1. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Unauthorized modification of dataCVE-2024-1322 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.8.4
What to do
Affects up to 7.8.4. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Unauthorized modification of dataCVE-2024-1318 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with Contributor access and above, who are normally restricted to only being able to create posts rather than pages, to draft and publish posts with arbitrary content.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Schema & Structured Data for WP & AMP: Unauthorized modification of dataCVE-2024-1288 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all versions up to, and including, 1.26. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's stored reCaptcha site and secret keys, potentially breaking the reCaptcha functionality.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.26
What to do
Affects up to 1.26. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Unauthorized access and modification of dataCVE-2024-1218 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.41
What to do
Affects up to 2.3.41. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Unauthorized plugin deactivationCVE-2024-1217 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.41
What to do
Affects up to 2.3.41. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Tutor LMS – eLearning and online course solution: Unauthorized access of restricted Q&A contentCVE-2024-1133 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-1130 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as read.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-1129 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as starred.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-1091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reinitialize function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to remove all plugin data.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-1090 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stopOptimizeAll function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify image optimization settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-1089 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optimizeAllOn function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify image optimization settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Customer Reviews for WooCommerce: Unauthorized modification of dataCVE-2024-1044 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.12
What to do
Affects up to 5.38.12. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024AMP for WP – Accelerated Mobile Pages: Unauthorized loss of dataCVE-2024-1043 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remove_saved_layout_data' function in all versions up to, and including, 1.0.93.1. This makes it possible for authenticated attackers, with contributor access and above, to delete arbitrary posts on the site.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.0.93.1
What to do
Affects up to 1.0.93.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-0984 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to disable the image optimization setting.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-0983 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable image optimization.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-0907 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restore_records() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to restore records.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Oliver POS – A WooCommerce Point of Sale (POS): Unauthorized accessCVE-2024-0702 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.
Product
Oliver POS – A WooCommerce Point of Sale (POS)
Affected
up to 2.4.2.1
What to do
Affects up to 2.4.2.1. Update Oliver POS – A WooCommerce Point of Sale (POS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Royal Elementor Addons and Templates: Unauthorized post metadata updateCVE-2024-0516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.87
What to do
Affects up to 1.3.87. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user.CVE-2023-38372 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user. IBM X-Force ID: 261201.
Product
Watson IoT Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 28, 2024Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the CVE-2024-23910 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note that WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit "WMC-2LX-B".
Product
WRC-1167GS2-B
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp elecom.co.jp
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1861 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.52
What to do
Affects up to 4.52. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1860 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.51
What to do
Affects up to 4.51. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Redirects: Unauthorized modification of dataCVE-2024-1566 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Redirects plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to change redirects created with this plugin. This could lead to undesired redirection to phishing sites or malicious web pages.
Product
Redirects
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024WP eCommerce: Unauthorized arbitrary post creationCVE-2024-1516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrary content.
Product
WP eCommerce
Affected
up to 3.15.1
What to do
Affects up to 3.15.1. Update WP eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Page Duplicator: Unauthorized modification of dataCVE-2024-1368 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_dat_page() function in all versions up to, and including, 0.1.1. This makes it possible for unauthenticated attackers to duplicate arbitrary posts and pages.
Product
Page Duplicator
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Page Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Coming Soon Page & Maintenance Mode: Unauthorized access of dataCVE-2024-1136 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wpsm_coming_soon_redirect function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to view a site with maintenance mode or coming-soon mode enabled to view the site's content.
Product
Coming Soon Page & Maintenance Mode
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Envo's Elementor Templates & Widgets for WooCommerce: Unauthorized modification of dataCVE-2024-0766 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.
Product
Envo's Elementor Templates & Widgets for WooCommerce
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Envo's Elementor Templates & Widgets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Yuki: Unauthorized modification of dataCVE-2024-1388 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings.
Product
Yuki
Affected
up to 1.3.13
What to do
Affects up to 1.3.13. Update Yuki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Feb 27, 2024** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora.CVE-2024-27905 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Product
Apache Aurora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1653 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosition in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the folder position of categories as well as update the metadata of other taxonomies.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1652 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear categories.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1650 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Categorify: Unauthorized modification of dataCVE-2024-1649 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete categories.
Product
Categorify
Affected
up to 1.0.7.4
What to do
Affects up to 1.0.7.4. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Thank You Page Customizer for WooCommerce – Increase Your Sales: Unauthorized execution of shortcodesCVE-2024-1687 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
Thank You Page Customizer for WooCommerce – Increase Your Sales
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Thank You Page Customizer for WooCommerce – Increase Your Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 26, 2024Addon Library: Unauthorized access of dataCVE-2024-1710 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions including uploading arbitrary files.
Product
Addon Library
Affected
up to 1.3.76
What to do
Affects up to 1.3.76. Update Addon Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 26, 2024WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-1436 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: from n/a through 1.0.9.
Product
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.