Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,660 results · page 342 of 494
Nov 1, 2024Clone: Missing AuthorizationCVE-2024-43297 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
- Product
- Clone
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Flash & HTML5 Video: Missing AuthorizationCVE-2024-43296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.
- Product
- Flash & HTML5 Video
- Affected
- up to 2.5.30
- What to do
- Affects up to 2.5.30. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2024-43293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.3.1.
- Product
- Recipe Card Blocks for Gutenberg & Elementor
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Atarim: Missing AuthorizationCVE-2024-43290 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 4.0.1.
- Product
- Atarim
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Presto Player: Missing AuthorizationCVE-2024-43285 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Presto Made, Inc Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Presto Player: from n/a through 3.0.2.
- Product
- Presto Player
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024UsersWP: Missing AuthorizationCVE-2024-43277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.
- Product
- UsersWP
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2024-43274 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Icegram Collect: Missing AuthorizationCVE-2024-43273 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect plugin: from n/a through 1.3.14.
- Product
- Icegram Collect
- Affected
- up to 1.3.14
- What to do
- Affects up to 1.3.14. Update Icegram Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Backup and Restore: Missing AuthorizationCVE-2024-43270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPBackItUp Backup and Restore WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Backup and Restore WordPress: from n/a through 1.50.
- Product
- Backup and Restore
- Affected
- up to 1.50
- What to do
- Affects up to 1.50. Update Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Clearfy Cache: Missing AuthorizationCVE-2024-43260 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clearfy Cache: from n/a through 2.2.4.
- Product
- Clearfy Cache
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Clearfy Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Smart Online Order for Clover: Missing AuthorizationCVE-2024-43254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.
- Product
- Smart Online Order for Clover
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Smart Online Order for Clover: Missing AuthorizationCVE-2024-43253 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.
- Product
- Smart Online Order for Clover
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2024-43235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.
- Product
- Meta Box – WordPress Custom Fields Framework
- Affected
- up to 5.9.10
- What to do
- Affects up to 5.9.10. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Search Analytics: Missing AuthorizationCVE-2024-43229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cornel Raiu WP Search Analytics search-analytics.This issue affects WP Search Analytics: from n/a through <= 1.4.9.
- Product
- WP Search Analytics
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update WP Search Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024EventPrime: Missing AuthorizationCVE-2024-43223 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2.
- Product
- EventPrime
- Affected
- up to 4.0.3.2
- What to do
- Affects up to 4.0.3.2. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Persian WooCommerce: Missing AuthorizationCVE-2024-43219 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ووکامرس فارسی Persian WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Persian WooCommerce: from n/a through 7.1.6.
- Product
- Persian WooCommerce
- Affected
- up to 7.1.6
- What to do
- Affects up to 7.1.6. Update Persian WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Social Slider Feed: Missing AuthorizationCVE-2024-43215 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in creativemotion Social Slider Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Slider Feed: from n/a through 2.2.2.
- Product
- Social Slider Feed
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Social Slider Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WpTravelly: Missing AuthorizationCVE-2024-43212 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in MagePeople Team WpTravelly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through 1.7.7.
- Product
- WpTravelly
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024MailChimp Subscribe Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43211 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms allows Stored XSS.This issue affects MailChimp Subscribe Forms : from n/a through 4.0.9.9.
- Product
- MailChimp Subscribe Forms
- Affected
- up to 4.0.9.9
- What to do
- Affects up to 4.0.9.9. Update MailChimp Subscribe Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Bitly: Missing AuthorizationCVE-2024-43209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Bitly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bitly: from n/a through 2.7.2.
- Product
- Bitly
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Bitly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Send Emails with Mandrill: Missing AuthorizationCVE-2024-43208 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Matt Miller Send Emails with Mandrill send-emails-with-mandrill allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Send Emails with Mandrill: from n/a through <= 1.4.1.
- Product
- Send Emails with Mandrill
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Send Emails with Mandrill to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Easy Digital Downloads: Missing AuthorizationCVE-2024-43162 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
- Product
- Easy Digital Downloads
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masteriyo - LMS: Missing AuthorizationCVE-2024-43159 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.6.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.6
- What to do
- Affects up to 1.11.6. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masteriyo - LMS: Missing AuthorizationCVE-2024-43158 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.4
- What to do
- Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024FormCraft: Missing AuthorizationCVE-2024-43157 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10.
- Product
- FormCraft
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Cron Manager – debug & control: Missing AuthorizationCVE-2024-43154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.
- Product
- Advanced Cron Manager – debug & control
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024AMP for WP: Missing AuthorizationCVE-2024-43146 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AMP for WP: from n/a through 1.0.96.1.
- Product
- AMP for WP
- Affected
- up to 1.0.96.1
- What to do
- Affects up to 1.0.96.1. Update AMP for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Registrations for the Events Calendar: Missing AuthorizationCVE-2024-43143 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Roundup WP Registrations for the Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registrations for the Events Calendar: from n/a through 2.12.1.
- Product
- Registrations for the Events Calendar
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Registrations for the Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Tutor LMS: Missing AuthorizationCVE-2024-43142 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.
- Product
- Tutor LMS
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-43136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.1.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Waitlist Woocommerce ( Back in stock notifier ): Missing AuthorizationCVE-2024-43134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.6.
- Product
- Waitlist Woocommerce ( Back in stock notifier )
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Robin image optimizer: Missing AuthorizationCVE-2024-43122 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Creative Motion Robin image optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robin image optimizer: from n/a through 1.6.9.
- Product
- Robin image optimizer
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Robin image optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024TypeSquare Webfonts: Missing AuthorizationCVE-2024-43120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in XSERVER Inc. TypeSquare Webfonts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TypeSquare Webfonts: from n/a through 2.0.7.
- Product
- TypeSquare Webfonts
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update TypeSquare Webfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Aruba HiSpeed Cache: Missing AuthorizationCVE-2024-43119 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Aruba.It Aruba HiSpeed Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.12.
- Product
- Aruba HiSpeed Cache
- Affected
- up to 2.0.12
- What to do
- Affects up to 2.0.12. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Hummingbird: Missing AuthorizationCVE-2024-43118 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.
- Product
- Hummingbird
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Filter & Grids: Missing AuthorizationCVE-2024-39664 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in YMC Filter & Grids allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Filter & Grids: from n/a through 2.8.33.
- Product
- Filter & Grids
- Affected
- up to 2.8.33
- What to do
- Affects up to 2.8.33. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sign-up Sheets: Missing AuthorizationCVE-2024-39654 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets.This issue affects Sign-up Sheets: from n/a through <= 2.2.12.
- Product
- Sign-up Sheets
- Affected
- up to 2.2.12
- What to do
- Affects up to 2.2.12. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WooCommerce PDF Vouchers: Missing AuthorizationCVE-2024-39650 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.5
- What to do
- Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Nov 1, 2024WP Social Feed Gallery: Missing AuthorizationCVE-2024-39640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in QuadLayers WP Social Feed Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 4.3.9.
- Product
- WP Social Feed Gallery
- Affected
- up to 4.3.9
- What to do
- Affects up to 4.3.9. Update WP Social Feed Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Youzify: Missing AuthorizationCVE-2024-39635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in KaineLabs Youzify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youzify: from n/a through 1.2.6.
- Product
- Youzify
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Youzify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Icegram: Missing AuthorizationCVE-2024-39625 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24.
- Product
- Icegram
- Affected
- up to 3.1.24
- What to do
- Affects up to 3.1.24. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Custom Query Blocks: Missing AuthorizationCVE-2024-38794 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MediaRon LLC Custom Query Blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Custom Query Blocks: from n/a through 5.2.0.
- Product
- Custom Query Blocks
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Language Translate Widget for WordPress – ConveyThis: Missing AuthorizationCVE-2024-38792 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ConveyThis Translate Team Language Translate Widget for WordPress – ConveyThis allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Language Translate Widget for WordPress – ConveyThis: from n/a through 234.
- Product
- Language Translate Widget for WordPress – ConveyThis
- Affected
- up to 234
- What to do
- Affects up to 234. Update Language Translate Widget for WordPress – ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Arconix FAQ: Missing AuthorizationCVE-2024-38783 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tyche Softwares Arconix FAQ allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix FAQ: from n/a through 1.9.4.
- Product
- Arconix FAQ
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Titan Anti-spam & Security: Missing AuthorizationCVE-2024-38777 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CreativeMotion Titan Anti-spam & Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Titan Anti-spam & Security: from n/a through 7.3.6.
- Product
- Titan Anti-spam & Security
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update Titan Anti-spam & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024SiteGround Security: Missing AuthorizationCVE-2024-38774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SiteGround SiteGround Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through 1.5.0.
- Product
- SiteGround Security
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Atarim: Missing AuthorizationCVE-2024-38771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 4.0.
- Product
- Atarim
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Arconix Shortcodes: Missing AuthorizationCVE-2024-38769 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tyche Softwares Arconix Shortcodes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix Shortcodes: from n/a through 2.1.11.
- Product
- Arconix Shortcodes
- Affected
- up to 2.1.11
- What to do
- Affects up to 2.1.11. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Wholesale Suite: Missing AuthorizationCVE-2024-38745 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wholesale Suite: from n/a through 2.1.12.
- Product
- Wholesale Suite
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update Wholesale Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Plum: Spin Wheel & Email Pop-up: Missing AuthorizationCVE-2024-38744 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
- Product
- Plum: Spin Wheel & Email Pop-up
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Plum: Spin Wheel & Email Pop-up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.