Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,631 results · page 34 of 73
Sep 17, 2024Visual Sound (old): Does not have CSRF check in placeCVE-2024-8047 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound (old)
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Visual Sound (old) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024infolinks Ad Wrap: Does not have CSRF check in placeCVE-2024-8044 · WordPress plugins & themes · reported by WPScanMedium 6.5
The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- infolinks Ad Wrap
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update infolinks Ad Wrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Vikinghammer Tweet: Does not have CSRF check in some placesCVE-2024-8043 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Vikinghammer Tweet
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Vikinghammer Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Favicon Generator (CLOSED): Does not have CSRF and path validation in the output_sub_admin_page_0() functionCVE-2024-7864 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
- Product
- Favicon Generator (CLOSED)
- Fixed in
- 2.1
- What to do
- Update Favicon Generator (CLOSED) to 2.1 or newer.
Sep 13, 2024Favicon Generator (CLOSED): Does not validate files to be uploaded and does not have CSRF checksCVE-2024-7863 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
- Product
- Favicon Generator (CLOSED)
- Fixed in
- 2.1
- What to do
- Update Favicon Generator (CLOSED) to 2.1 or newer.
Sep 12, 2024MM-Breaking News: Does not have CSRF check in some placesCVE-2024-8054 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- MM-Breaking News
- Affected
- up to 0.7.9
- What to do
- Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024blogintroduction-wordpress-plugin: Does not have CSRF check in placeCVE-2024-7862 · WordPress plugins & themes · reported by WPScanMedium 6.5
The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- blogintroduction-wordpress-plugin
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update blogintroduction-wordpress-plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Paypal: Does not have CSRF check in some placesCVE-2024-7861 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Paypal
- Affected
- up to 1.1.20090324
- What to do
- Affects up to 1.1.20090324. Update Misiek Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Simple Headline Rotator: Does not have CSRF check in some placesCVE-2024-7860 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Simple Headline Rotator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Headline Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Visual Sound: Does not have CSRF check in placeCVE-2024-7859 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update Visual Sound to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Quick Code: Does not have CSRF check in some placesCVE-2024-7822 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Quick Code
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Quick Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024ILC Thickbox: Does not have CSRF check in placeCVE-2024-7820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ILC Thickbox
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update ILC Thickbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF check in some placesCVE-2024-7818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF checks in some placesCVE-2024-7817 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Gixaw Chat: Does not have CSRF check in some placesCVE-2024-7816 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Gixaw Chat
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Gixaw Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Music Request Manager: Does not have CSRF check in some placesCVE-2024-6017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Easy Property Listings: Does not have CSRF checkCVE-2024-3163 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
Sep 9, 2024Snapshot Backup: Does not have CSRF check in some placesCVE-2024-7689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Snapshot Backup
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Snapshot Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF checks in some placesCVE-2024-7688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF check in some placesCVE-2024-7687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024TrueBooker: Does not have CSRF check in placeCVE-2024-6925 · WordPress plugins & themes · reported by WPScanMedium 4.3
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6856 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6855 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6852 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2024DN Popup: Does not have CSRF check in placeCVE-2024-7690 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Popup
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update DN Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024WP Armour Extended: Cross-Site Request Forgery (CSRF)CVE-2024-43947 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.
- Product
- WP Armour Extended
- Affected
- up to 1.26
- What to do
- Affects up to 1.26. Update WP Armour Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024oik: Cross-Site Request Forgery (CSRF)CVE-2024-43356 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0.
- Product
- oik
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Advanced Form Integration: Cross-Site Request Forgery (CSRF)CVE-2024-43340 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.
- Product
- Advanced Form Integration
- Affected
- up to 1.89.4
- What to do
- Affects up to 1.89.4. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024WebinarPress: Cross-Site Request Forgery (CSRF)CVE-2024-43339 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.
- Product
- WebinarPress
- Affected
- up to 1.33.20
- What to do
- Affects up to 1.33.20. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Brave Popup Builder: Cross-Site Request Forgery (CSRF)CVE-2024-43337 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.
- Product
- Brave Popup Builder
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update Brave Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024WP User Manager: Cross-Site Request Forgery (CSRF)CVE-2024-43336 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9.10.
- Product
- WP User Manager
- Affected
- up to 2.9.10
- What to do
- Affects up to 2.9.10. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Dark Mode for WP Dashboard: Cross-Site Request Forgery (CSRF)CVE-2024-43325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.
- Product
- Dark Mode for WP Dashboard
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Dark Mode for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Stripe Payments For WooCommerce by Checkout: Cross-Site Request Forgery (CSRF)CVE-2024-43316 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
- Product
- Stripe Payments For WooCommerce by Checkout
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Fonts: Cross-Site Request Forgery (CSRF)CVE-2024-43301 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7.
- Product
- Fonts
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024SpeedyCache: Cross-Site Request Forgery (CSRF)CVE-2024-43299 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8.
- Product
- SpeedyCache
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update SpeedyCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024WP Data Access: Cross-Site Request Forgery (CSRF)CVE-2024-43295 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7.
- Product
- WP Data Access
- Affected
- up to 5.5.7
- What to do
- Affects up to 5.5.7. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Cross-Site Request Forgery (CSRF)CVE-2024-43287 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82.
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Affected
- up to 3.1.82
- What to do
- Affects up to 3.1.82. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Backup and Restore: Cross-Site Request Forgery (CSRF)CVE-2024-43269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1.50.
- Product
- Backup and Restore
- Affected
- up to 1.50
- What to do
- Affects up to 1.50. Update Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Analytify: Cross-Site Request Forgery (CSRF)CVE-2024-43265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1.
- Product
- Analytify
- Affected
- up to 5.3.1
- What to do
- Affects up to 5.3.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Hummingbird: Cross-Site Request Forgery (CSRF)CVE-2024-43117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.
- Product
- Hummingbird
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Simple Local Avatars: Cross-Site Request Forgery (CSRF)CVE-2024-43116 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.
- Product
- Simple Local Avatars
- Affected
- up to 2.7.10
- What to do
- Affects up to 2.7.10. Update Simple Local Avatars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-39657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
- Product
- Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
- Affected
- up to 2.6.18
- What to do
- Affects up to 2.6.18. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Tutor LMS: Cross-Site Request Forgery (CSRF)CVE-2024-39645 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
- Product
- Tutor LMS
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024LearnPress: Cross-Site Request Forgery (CSRF)CVE-2024-39641 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.
- Product
- LearnPress
- Affected
- up to 4.2.6.8.2
- What to do
- Affects up to 4.2.6.8.2. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2024-39628 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
- Product
- Ninja Forms
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Contact Form 7 Summary and Print: Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Muhammad Rehman Contact Form 7 Summary and Print allows Stored XSS.This issue affects Contact Form 7 Summary and Print: from n/a through 1.2.5.
- Product
- Contact Form 7 Summary and Print
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Contact Form 7 Summary and Print to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024wp-cart-for-digital-products: Does not have CSRF checks in some placesCVE-2024-6136 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.6
- What to do
- Update wp-cart-for-digital-products to 8.5.6 or newer.
Aug 6, 2024Light Poll: Does not have CSRF checks in some placesCVE-2024-6720 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5081 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-eMember
- Fixed in
- 10.7.0
- What to do
- Update wp-eMember to 10.7.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.