Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

395,110entries in the database

16,061 results · page 286 of 322

Jul 10, 2023Keith Solomon Configurable Tag Cloud: Cross-Site Request Forgery (CSRF)CVE-2023-28995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Keith Solomon Configurable Tag Cloud (CTC) plugin <= 5.2 versions.
Product
Keith Solomon Configurable Tag Cloud
Fixed in
5.3
What to do
Update Keith Solomon Configurable Tag Cloud to 5.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.CVE-2023-28989 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.
Fixed in
3.8.3
What to do
Update the plugin to 3.8.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.CVE-2023-28986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.
Fixed in
2.9.21
What to do
Update the plugin to 2.9.21 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Jason Rouet Weather Station plugin <= 3.8.12 versions.CVE-2023-25478 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jason Rouet Weather Station plugin <= 3.8.12 versions.
Affected
up to 3.8.12
What to do
Affects up to 3.8.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.CVE-2023-24405 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.
Fixed in
1.9.4
What to do
Update the plugin to 1.9.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.CVE-2023-24395 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.
Fixed in
1.0.4
What to do
Update the plugin to 1.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com LionScripts: IP Blocker Lite plugin <= 11.1.1 versions.CVE-2023-23993 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com LionScripts: IP Blocker Lite plugin <= 11.1.1 versions.
Affected
up to 11.1.1
What to do
Affects up to 11.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions.CVE-2023-23897 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions.
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Mobile plugin <= 1.6.1 versions.CVE-2023-23869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Mobile plugin <= 1.6.1 versions.
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions.CVE-2023-23804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions.
Fixed in
1.2.8
What to do
Update the plugin to 1.2.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.CVE-2023-23787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions.CVE-2023-22695 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions.
Fixed in
2.5.9
What to do
Update the plugin to 2.5.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions.CVE-2023-22694 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions.
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.CVE-2023-22673 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.
Affected
up to 1.0.29.1
What to do
Affects up to 1.0.29.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic.CVE-2015-10121 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnerability is the function embed_handler of the file beelikedmicrosite.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is d23bafb5d05fb2636a2b78331f9d3fca152903dc. It is recommended to upgrade the affected component. The identifier VDB-233365 was assigned to this vulnerability.
Product
Beeliked Microsite
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Beeliked Microsite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jul 1, 2023ElasticPress: Cross-Site Request ForgeryCVE-2021-4405 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers to send allowed parameters for autosuggest to elasticpress[.]io via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ElasticPress
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update ElasticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Event Espresso 4 Decaf: Cross-Site Request ForgeryCVE-2021-4404 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler() function. This makes it possible for unauthenticated attackers to op into notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Event Espresso 4 Decaf
Affected
up to 4.10.11
What to do
Affects up to 4.10.11. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Remove Schema: Cross-Site Request ForgeryCVE-2021-4403 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Remove Schema plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the validate() function. This makes it possible for unauthenticated attackers to modify the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Remove Schema
Affected
up to 1.5
What to do
Affects up to 1.5. Update Remove Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Multiple Roles: Cross-Site Request ForgeryCVE-2021-4402 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Multiple Roles plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the mu_add_roles_in_signup_meta() and mu_add_roles_in_signup_meta_recently() functions. This makes it possible for unauthenticated attackers to add additional roles to users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Multiple Roles
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Multiple Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Style Kits: Cross-Site Request ForgeryCVE-2021-4401 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the update_posts_stylekit() function. This makes it possible for unauthenticated attackers to update style kits for posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Style Kits
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Style Kits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Better Search: Cross-Site Request ForgeryCVE-2021-4400 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the bsearch_process_settings_import() and bsearch_process_settings_export() functions. This makes it possible for unauthenticated attackers to import and export settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Better Search
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Edwiser Bridge: Cross-Site Request ForgeryCVE-2021-4399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Edwiser Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,2.0.6. This is due to missing or incorrect nonce validation on the user_data_synchronization_initiater(), course_synchronization_initiater(), users_link_to_moodle_synchronization(), connection_test_initiater(), admin_menus(), and subscribe_handler() function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Edwiser Bridge
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Amministrazione Trasparente: Cross-Site Request ForgeryCVE-2021-4398 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. This is due to missing or incorrect nonce validation on the at_save_aturl_meta() function. This makes it possible for unauthenticated attackers to update meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Amministrazione Trasparente
Affected
up to 7.1
What to do
Affects up to 7.1. Update Amministrazione Trasparente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Staff Directory: Cross-Site Request ForgeryCVE-2021-4397 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Staff Directory
Affected
up to 3.6
What to do
Affects up to 3.6. Update Staff Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Rucy: Cross-Site Request ForgeryCVE-2021-4396 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce validation on the save_rc_post_meta() function. This makes it possible for unauthenticated attackers to save post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Rucy
Affected
up to 0.4.4
What to do
Affects up to 0.4.4. Update Rucy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Abandoned Cart Recovery for WooCommerce: Cross-Site Request ForgeryCVE-2021-4395 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the get_items() and extra_tablenav() functions. This makes it possible for unauthenticated attackers to perform read-only actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Abandoned Cart Recovery for WooCommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Abandoned Cart Recovery for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Easy Testimonials: Cross-Site Request ForgeryCVE-2020-36749 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Testimonials
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Easy Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Dokan: Cross-Site Request ForgeryCVE-2020-36748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce validation on the handle_order_export() function. This makes it possible for unauthenticated attackers to trigger an order export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Dokan
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Lightweight Sidebar Manager: Cross-Site Request ForgeryCVE-2020-36747 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the metabox_save() function. This makes it possible for unauthenticated attackers to save metbox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Lightweight Sidebar Manager
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Lightweight Sidebar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Menu Swapper: Cross-Site Request ForgeryCVE-2020-36746 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to missing or incorrect nonce validation on the mswp_save_meta() function. This makes it possible for unauthenticated attackers to save meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Menu Swapper
Affected
up to 1.1.0.2
What to do
Affects up to 1.1.0.2. Update Menu Swapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Locations: Cross-Site Request ForgeryCVE-2021-4394 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to update custom field meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Locations
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2021-4393 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save manual digital orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
eCommerce Product Catalog Plugin for
Affected
up to 3.0.17
What to do
Affects up to 3.0.17. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2021-4392 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to save product meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
eCommerce Product Catalog Plugin for
Affected
up to 2.9.43
What to do
Affects up to 2.9.43. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Ultimate Gift Cards for WooCommerce: Cross-Site Request ForgeryCVE-2021-4391 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the mwb_wgm_save_post() function. This makes it possible for unauthenticated attackers to modify product gift card details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ultimate Gift Cards for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Ultimate Gift Cards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Contact Form 7 Style: Cross-Site Request ForgeryCVE-2021-4390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_wp_posts_be_qe_save_post() function. This makes it possible for unauthenticated attackers to quick edit templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Contact Form 7 Style
Affected
up to 3.2
What to do
Affects up to 3.2. Update Contact Form 7 Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WP Travel: Cross-Site Request ForgeryCVE-2021-4389 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect nonce validation on the save_meta_data() function. This makes it possible for unauthenticated attackers to save metadata for travel posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Travel
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WP Project Manager: Cross-Site Request ForgeryCVE-2020-36745 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or incorrect nonce validation on the do_updates() function. This makes it possible for unauthenticated attackers to trigger updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Project Manager
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023NotificationX: Cross-Site Request ForgeryCVE-2020-36744 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect nonce validation on the generate_conversions() function. This makes it possible for unauthenticated attackers to generate conversions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
NotificationX
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Product Catalog Simple: Cross-Site Request ForgeryCVE-2020-36743 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to update product meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Product Catalog Simple
Affected
up to 1.5.13
What to do
Affects up to 1.5.13. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Custom Field Template: Cross-Site Request ForgeryCVE-2020-36742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the edit_meta_value() function. This makes it possible for unauthenticated attackers to edit meta field values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom Field Template
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023MultiVendorX: Cross-Site Request ForgeryCVE-2020-36741 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to missing or incorrect nonce validation on the submit_comment() function. This makes it possible for unauthenticated attackers to submit comments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MultiVendorX
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Radio Buttons for Taxonomies: Cross-Site Request ForgeryCVE-2020-36740 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the save_single_term() function. This makes it possible for unauthenticated attackers to save terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Radio Buttons for Taxonomies
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Radio Buttons for Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Opal Estate: Cross-Site Request ForgeryCVE-2021-4387 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect nonce validation on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Opal Estate
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update Opal Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WP Security Question: Cross-Site Request ForgeryCVE-2021-4386 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Security Question
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Security Question to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WP Private Content Plus: Cross-Site Request ForgeryCVE-2021-4385 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_groups() function. This makes it possible for unauthenticated attackers to add new group members via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Private Content Plus
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Private Content Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WordPress Photo Gallery – Image Gallery: Cross-Site Request ForgeryCVE-2021-4384 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the load_images_thumbnail() and edit_gallery() functions. This makes it possible for unauthenticated attackers to edit galleries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WordPress Photo Gallery – Image Gallery
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WordPress Photo Gallery – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Feed Them Social – Page, Post, Video, and Photo Galleries: Cross-Site Request ForgeryCVE-2020-36739 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the my_fts_fb_load_more() function. This makes it possible for unauthenticated attackers to load feeds via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Feed Them Social – Page, Post, Video, and Photo Galleries
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Feed Them Social – Page, Post, Video, and Photo Galleries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Cool Timeline (Horizontal & Vertical Timeline): Cross-Site Request ForgeryCVE-2020-36738 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the ctl_save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Cool Timeline (Horizontal & Vertical Timeline)
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Cool Timeline (Horizontal & Vertical Timeline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Import / Export Customizer Settings: Cross-Site Request ForgeryCVE-2020-36737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Import / Export Customizer Settings
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Import / Export Customizer Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WooCommerce Checkout & Funnel Builder by CartFlows: Cross-Site Request ForgeryCVE-2020-36736 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the export_json, import_json, and status_logs_file functions. This makes it possible for unauthenticated attackers to import/export settings and trigger logs showing via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WooCommerce Checkout & Funnel Builder by CartFlows
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update WooCommerce Checkout & Funnel Builder by CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.