Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,660 results · page 341 of 494
Nov 4, 2024Stacks Mobile App Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
- Product
- Stacks Mobile App Builder
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Media LIbrary Assistant: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-51661 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.
- Product
- Media LIbrary Assistant
- Affected
- up to 3.19
- What to do
- Affects up to 3.19. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ReCaptcha Integration for: Reflected Cross-Site ScriptingCVE-2024-8739 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- ReCaptcha Integration for
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ReCaptcha Integration for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: SQL InjectionCVE-2024-10540 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
- Affected
- up to 1.1.16
- What to do
- Affects up to 1.1.16. Update Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Htaccess File Editor: Incorrect AuthorizationCVE-2024-49256 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.
- Product
- Htaccess File Editor
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Htaccess File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Happy Addons for Elementor: Missing AuthorizationCVE-2024-48045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.3.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.12.3
- What to do
- Affects up to 3.12.3. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ShortPixel Image Optimizer: Missing AuthorizationCVE-2024-48044 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
- Product
- ShortPixel Image Optimizer
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024CubeWP: Missing AuthorizationCVE-2024-48039 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP: from n/a through <= 1.1.15.
- Product
- CubeWP
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Strong Testimonials: Missing AuthorizationCVE-2024-47362 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
- Product
- Strong Testimonials
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Elementor Addon Elements: Missing AuthorizationCVE-2024-47361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.
- Product
- Elementor Addon Elements
- Affected
- up to 1.13.6
- What to do
- Affects up to 1.13.6. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Popup Maker: Missing AuthorizationCVE-2024-47358 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.
- Product
- Popup Maker
- Affected
- up to 1.19.2
- What to do
- Affects up to 1.19.2. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Datepicker: Missing AuthorizationCVE-2024-47321 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.
- Product
- WP Datepicker
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024PWA for WP & AMP: Missing AuthorizationCVE-2024-47318 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.
- Product
- PWA for WP & AMP
- Affected
- up to 1.7.72
- What to do
- Affects up to 1.7.72. Update PWA for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ads by WPQuads: Missing AuthorizationCVE-2024-47317 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84.
- Product
- Ads by WPQuads
- Affected
- up to 2.0.84
- What to do
- Affects up to 2.0.84. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-47314 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.8.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Wheel of Life: Missing AuthorizationCVE-2024-47311 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.1.8.
- Product
- Wheel of Life
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Wheel of Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Templately: Missing AuthorizationCVE-2024-47308 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.
- Product
- Templately
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Fluent Support: Missing AuthorizationCVE-2024-47302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.8.0.
- Product
- Fluent Support
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Fluent Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024HelloAsso: Missing AuthorizationCVE-2024-44052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.
- Product
- HelloAsso
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-44038 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JoomSport: Missing AuthorizationCVE-2024-44031 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.
- Product
- JoomSport
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update JoomSport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Truepush: Missing AuthorizationCVE-2024-44021 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8.
- Product
- Truepush
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Truepush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: Missing AuthorizationCVE-2024-44020 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.
- Product
- WP Free SSL – Free SSL Certificate for WordPress and force HTTPS
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WP Free SSL – Free SSL Certificate for WordPress and force HTTPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Contact Form 7 Campaign Monitor Extension: Missing AuthorizationCVE-2024-44019 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.
- Product
- Contact Form 7 Campaign Monitor Extension
- Affected
- up to 0.4.67
- What to do
- Affects up to 0.4.67. Update Contact Form 7 Campaign Monitor Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WooCommerce Multilingual & Multicurrency: Missing AuthorizationCVE-2024-44006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.
- Product
- WooCommerce Multilingual & Multicurrency
- Affected
- up to 5.3.6
- What to do
- Affects up to 5.3.6. Update WooCommerce Multilingual & Multicurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Blogpoet: Missing AuthorizationCVE-2024-43998 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.
- Product
- Blogpoet
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Blogpoet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Login As Users: Missing AuthorizationCVE-2024-43982 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3.
- Product
- Login As Users
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024GeoDirectory: Missing AuthorizationCVE-2024-43981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
- Product
- GeoDirectory
- Affected
- up to 2.3.70
- What to do
- Affects up to 2.3.70. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Fota WP: Missing AuthorizationCVE-2024-43980 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.
- Product
- Fota WP
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Fota WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Blockbooster: Missing AuthorizationCVE-2024-43979 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.
- Product
- Blockbooster
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Blockbooster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ReviveNews: Missing AuthorizationCVE-2024-43974 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.
- Product
- ReviveNews
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update ReviveNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024GetPaid: Missing AuthorizationCVE-2024-43973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.
- Product
- GetPaid
- Affected
- up to 2.8.11
- What to do
- Affects up to 2.8.11. Update GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024LWS Affiliation: Missing AuthorizationCVE-2024-43962 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.
- Product
- LWS Affiliation
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update LWS Affiliation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Memberpress: Missing AuthorizationCVE-2024-43956 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34.
- Product
- Memberpress
- Affected
- up to 1.11.34
- What to do
- Affects up to 1.11.34. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Crowdfunding: Missing AuthorizationCVE-2024-43937 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024The Plus Addons for Elementor Page Builder Lite: Missing AuthorizationCVE-2024-43932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JobSearch: Missing AuthorizationCVE-2024-43929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a through 2.5.4.
- Product
- JobSearch
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JobSearch: Missing AuthorizationCVE-2024-43928 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4.
- Product
- JobSearch
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-43925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14.
- Product
- Envira Photo Gallery
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-43923 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.
- Product
- Timetics
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JoomSport: Missing AuthorizationCVE-2024-43355 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0.
- Product
- JoomSport
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update JoomSport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Order Tracking: Missing AuthorizationCVE-2024-43343 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Order Tracking: from n/a through 3.3.12.
- Product
- Order Tracking
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Hello Agency: Missing AuthorizationCVE-2024-43341 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5.
- Product
- Hello Agency
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Hello Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Photo Engine: Missing AuthorizationCVE-2024-43332 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.
- Product
- Photo Engine
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update Photo Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ReviewX: Missing AuthorizationCVE-2024-43323 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.28.
- Product
- ReviewX
- Affected
- up to 1.6.28
- What to do
- Affects up to 1.6.28. Update ReviewX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Asset CleanUp: Page Speed Booster: Missing AuthorizationCVE-2024-43314 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.3.9.3
- What to do
- Affects up to 1.3.9.3. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WPC Frequently Bought Together for WooCommerce: Missing AuthorizationCVE-2024-43312 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.
- Product
- WPC Frequently Bought Together for WooCommerce
- Affected
- up to 7.1.9
- What to do
- Affects up to 7.1.9. Update WPC Frequently Bought Together for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2024-43310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through 3.4.9.
- Product
- Print Barcode Labels for your WooCommerce products/orders
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Fonts: Missing AuthorizationCVE-2024-43302 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fonts Plugin Fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fonts: from n/a through 3.7.7.
- Product
- Fonts
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Clone: Missing AuthorizationCVE-2024-43298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
- Product
- Clone
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.