Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
159 results · page 3 of 4
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Incorrect Privilege AssignmentCVE-2025-48129 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025MapSVG: Incorrect Privilege AssignmentCVE-2025-47561 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
Jun 9, 2025One-Login: Incorrect Privilege AssignmentCVE-2025-23974 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in ifkooo One-Login one-login allows Privilege Escalation.This issue affects One-Login: from n/a through <= 1.4.
- Product
- One-Login
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update One-Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Hospital Management System: Incorrect Privilege AssignmentCVE-2025-47631 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in mojoomla Hospital Management System allows Privilege Escalation. This issue affects Hospital Management System: from 47.0(20 through 11.
- Product
- Hospital Management System
- Affected
- up to 11
- What to do
- Affects up to 11. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Eventin: Incorrect Privilege AssignmentCVE-2025-47539 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.
- Product
- Eventin
- Affected
- up to 4.0.26
- What to do
- Affects up to 4.0.26. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025CouponXL: Incorrect Privilege AssignmentCVE-2025-39489 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0.
- Product
- CouponXL
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update CouponXL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Simple Business Directory Pro: Incorrect Privilege AssignmentCVE-2025-31918 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.
- Product
- Simple Business Directory Pro
- What to do
- Update Simple Business Directory Pro to the newest version.
May 19, 2025wProject: Incorrect Privilege AssignmentCVE-2025-39366 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.
- Product
- wProject
- Fixed in
- 5.8.0
- What to do
- Update wProject to 5.8.0 or newer.
May 19, 2025Real Estate 7: Incorrect Privilege AssignmentCVE-2025-39459 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2.
- Product
- Real Estate 7
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Incorrect Privilege AssignmentCVE-2025-39405 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2025OttoKit: Incorrect Privilege AssignmentCVE-2025-27007 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82.
- Product
- OttoKit
- Affected
- up to 1.0.82
- What to do
- Affects up to 1.0.82. Update OttoKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Xelion Webchat: Incorrect Privilege AssignmentCVE-2025-39542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Jauhari Xelion Xelion Webchat xelion-webchat allows Privilege Escalation.This issue affects Xelion Webchat: from n/a through <= 9.1.0.
- Product
- Xelion Webchat
- Affected
- up to 9.1.0
- What to do
- Affects up to 9.1.0. Update Xelion Webchat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Projectopia: Incorrect Privilege AssignmentCVE-2025-32648 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Projectopia Projectopia projectopia-core allows Privilege Escalation.This issue affects Projectopia: from n/a through <= 5.1.24.
- Product
- Projectopia
- Affected
- up to 5.1.24
- What to do
- Affects up to 5.1.24. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Rankology SEO – On-site SEO: Incorrect Privilege AssignmentCVE-2025-32491 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Rankology Rankology SEO – On-site SEO rankology-seo-all-in-one-seo-analytics allows Privilege Escalation.This issue affects Rankology SEO – On-site SEO: from n/a through <= 2.2.4.
- Product
- Rankology SEO – On-site SEO
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Rankology SEO – On-site SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025WP User Profiles: Incorrect Privilege AssignmentCVE-2025-31524 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through <= 2.6.2.
- Product
- WP User Profiles
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update WP User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Checkout Mestres WP: Incorrect Privilege AssignmentCVE-2025-32695 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through <= 8.7.5.
- Product
- Checkout Mestres WP
- Affected
- up to 8.7.5
- What to do
- Affects up to 8.7.5. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Homey: Incorrect Privilege AssignmentCVE-2024-51800 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.
- Product
- Homey
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025wpForo Forum: Incorrect Privilege AssignmentCVE-2025-31420 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through <= 2.4.2.
- Product
- wpForo Forum
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Salon booking system: Incorrect Privilege AssignmentCVE-2025-31560 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Privilege Escalation.This issue affects Salon booking system: from n/a through < 10.15.
- Product
- Salon booking system
- Affected
- up to 10.11
- What to do
- Affects up to 10.11. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025K Elements: Incorrect Privilege AssignmentCVE-2024-56000 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through < 5.4.0.
- Product
- K Elements
- What to do
- Update K Elements to the newest version.
Feb 4, 2025Admin and Site Enhancements (ASE): Incorrect Privilege AssignmentCVE-2025-24648 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.1.
- Product
- Admin and Site Enhancements (ASE)
- Affected
- up to 7.6.2.1
- What to do
- Affects up to 7.6.2.1. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Admin and Site Enhancements (ASE) Pro: Incorrect Privilege AssignmentCVE-2024-43333 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.2.1.
- Product
- Admin and Site Enhancements (ASE) Pro
- Affected
- up to 7.6.2.1
- What to do
- Affects up to 7.6.2.1. Update Admin and Site Enhancements (ASE) Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Homey Login Register: Incorrect Privilege AssignmentCVE-2024-51888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.
- Product
- Homey Login Register
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Homey Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Easy Real Estate: Incorrect Privilege AssignmentCVE-2024-32555 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate: from n/a through <= 2.2.9.
- Product
- Easy Real Estate
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Easy Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025DD Roles: Incorrect Privilege AssignmentCVE-2025-23528 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through <= 4.1.
- Product
- DD Roles
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update DD Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025User Management: Incorrect Privilege AssignmentCVE-2025-22736 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through <= 1.2.
- Product
- User Management
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPGuppy: Incorrect Privilege AssignmentCVE-2024-56280 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/a through <= 1.1.0.
- Product
- WPGuppy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Accessibility by AllAccessible: Incorrect Privilege AssignmentCVE-2024-49644 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Accessibility by AllAccessible: from n/a through <= 1.3.4.
- Product
- Accessibility by AllAccessible
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Accessibility by AllAccessible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPLMS: Incorrect Privilege AssignmentCVE-2024-56043 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024VibeBP: Incorrect Privilege AssignmentCVE-2024-56040 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.
- Product
- VibeBP
- Affected
- up to 1.9.9.4.1
- What to do
- Affects up to 1.9.9.4.1. Update VibeBP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024AI Magic: Incorrect Privilege AssignmentCVE-2024-56205 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a through <= 1.0.4.
- Product
- AI Magic
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update AI Magic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Simple Dashboard: Incorrect Privilege AssignmentCVE-2024-56071 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboard: from n/a through <= 2.0.
- Product
- Simple Dashboard
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Simple Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SSL Wireless SMS Notification: Incorrect Privilege AssignmentCVE-2024-56220 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.
- Product
- SSL Wireless SMS Notification
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024WooCommerce PDF Vouchers: Incorrect Privilege AssignmentCVE-2024-54383 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.9
- What to do
- Update WooCommerce PDF Vouchers to 4.9.9 or newer.
Dec 16, 2024SV100 Companion: Incorrect Privilege AssignmentCVE-2024-54229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Companion: from n/a through <= 2.0.02.
- Product
- SV100 Companion
- Affected
- up to 2.0.02
- What to do
- Affects up to 2.0.02. Update SV100 Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024KH Easy User Settings: Incorrect Privilege AssignmentCVE-2024-54365 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy User Settings: from n/a through <= 1.0.0.
- Product
- KH Easy User Settings
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update KH Easy User Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wp NssUser Register: Incorrect Privilege AssignmentCVE-2024-54363 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through <= 1.0.0.
- Product
- Wp NssUser Register
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Wp NssUser Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CE21 Suite: Incorrect Privilege AssignmentCVE-2024-54293 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.
- Product
- CE21 Suite
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024UserPlus: Incorrect Privilege AssignmentCVE-2024-52442 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in userplus UserPlus userplus allows Privilege Escalation.This issue affects UserPlus: from n/a through <= 2.0.
- Product
- UserPlus
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update UserPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Marketing Automation by AZEXO: Incorrect Privilege AssignmentCVE-2024-50506 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
- Product
- Marketing Automation by AZEXO
- Affected
- up to 1.27.80
- What to do
- Affects up to 1.27.80. Update Marketing Automation by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Bulk Change Role: Incorrect Privilege AssignmentCVE-2024-50504 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through <= 1.1.
- Product
- Bulk Change Role
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Bulk Change Role to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024LiteSpeed Cache: Incorrect Privilege AssignmentCVE-2024-50550 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.
- Product
- LiteSpeed Cache
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Exam Matrix: Incorrect Privilege AssignmentCVE-2024-50485 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through <= 1.5.
- Product
- Exam Matrix
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Exam Matrix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Bstone Demo Importer: Incorrect Privilege AssignmentCVE-2024-50481 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Demo Importer: from n/a through <= 1.0.1.
- Product
- Bstone Demo Importer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Bstone Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024GERRYWORKS Post by Mail: Incorrect Privilege AssignmentCVE-2024-49608 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through <= 1.0.
- Product
- GERRYWORKS Post by Mail
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update GERRYWORKS Post by Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Job Board Manager for: Incorrect Privilege AssignmentCVE-2024-49322 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through <= 1.0.
- Product
- Job Board Manager for
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Job Board Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024RS-Members: Incorrect Privilege AssignmentCVE-2024-49219 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1.0.3.
- Product
- RS-Members
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update RS-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Adding drop down roles in registration: Incorrect Privilege AssignmentCVE-2024-49217 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in madiriaashish Adding drop down roles in registration user-drop-down-roles-in-registration allows Privilege Escalation.This issue affects Adding drop down roles in registration: from n/a through <= 1.1.
- Product
- Adding drop down roles in registration
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Adding drop down roles in registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Houzez: Incorrect Privilege AssignmentCVE-2024-22303 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4.
- Product
- Houzez
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2024LiteSpeed Cache: Incorrect Privilege AssignmentCVE-2024-28000 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
- Product
- LiteSpeed Cache
- Affected
- up to 6.3.0.1
- What to do
- Affects up to 6.3.0.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compacketstorm.news
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.