Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,660 results · page 343 of 494
Nov 1, 2024Packlink PRO shipping module: Missing AuthorizationCVE-2024-38740 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Packlink Shipping S.L. Packlink PRO shipping module allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Packlink PRO shipping module: from n/a through 3.4.6.
- Product
- Packlink PRO shipping module
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update Packlink PRO shipping module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ReDi Restaurant Reservation: Missing AuthorizationCVE-2024-38737 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReDi Restaurant Reservation: from n/a through 24.0422.
- Product
- ReDi Restaurant Reservation
- Affected
- up to 24.0422
- What to do
- Affects up to 24.0422. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Meks Video Importer: Missing AuthorizationCVE-2024-38733 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Meks Meks Video Importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meks Video Importer: from n/a through 1.0.12.
- Product
- Meks Video Importer
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Meks Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Seraphinite Post .DOCX Source: Missing AuthorizationCVE-2024-38727 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.
- Product
- Seraphinite Post .DOCX Source
- Affected
- up to 2.16.9
- What to do
- Affects up to 2.16.9. Update Seraphinite Post .DOCX Source to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Product Designer: Missing AuthorizationCVE-2024-38726 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Designer: from n/a through 1.0.33.
- Product
- Product Designer
- Affected
- up to 1.0.33
- What to do
- Affects up to 1.0.33. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024EazyDocs: Missing AuthorizationCVE-2024-38721 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in spider-themes EazyDocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through 2.5.0.
- Product
- EazyDocs
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Auto Featured Image (Auto Post Thumbnail): Missing AuthorizationCVE-2024-38719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.1.2.
- Product
- Auto Featured Image (Auto Post Thumbnail)
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Fast Total Search: Missing AuthorizationCVE-2024-38714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.68.232.
- Product
- WP Fast Total Search
- Affected
- up to 1.68.232
- What to do
- Affects up to 1.68.232. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024EmbedPress: Missing AuthorizationCVE-2024-38707 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in WPDeveloper EmbedPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmbedPress: from n/a through 4.0.4.
- Product
- EmbedPress
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Product Delivery Date for WooCommerce – Lite: Missing AuthorizationCVE-2024-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.
- Product
- Product Delivery Date for WooCommerce – Lite
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP GoToWebinar: Missing AuthorizationCVE-2024-38695 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.
- Product
- WP GoToWebinar
- Affected
- up to 15.6
- What to do
- Affects up to 15.6. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-38690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024User Activity Log Pro: Missing AuthorizationCVE-2024-37929 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4.
- Product
- User Activity Log Pro
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update User Activity Log Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Accessibility Helper (WAH): Missing AuthorizationCVE-2024-37926 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.9.
- Product
- WP Accessibility Helper (WAH)
- Affected
- up to 0.6.2.9
- What to do
- Affects up to 0.6.2.9. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Chained Quiz: Missing AuthorizationCVE-2024-37921 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kiboko Labs Chained Quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chained Quiz: from n/a through 1.3.2.8.
- Product
- Chained Quiz
- Affected
- up to 1.3.2.8
- What to do
- Affects up to 1.3.2.8. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Spectra: Missing AuthorizationCVE-2024-37517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7.
- Product
- Spectra
- Affected
- up to 2.13.7
- What to do
- Affects up to 2.13.7. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37516 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.2.
- Product
- Featured Image from URL
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Charitable: Missing AuthorizationCVE-2024-37510 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.
- Product
- Charitable
- Affected
- up to 1.8.1.7
- What to do
- Affects up to 1.8.1.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Charitable: Missing AuthorizationCVE-2024-37506 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.
- Product
- Charitable
- Affected
- up to 1.8.1.7
- What to do
- Affects up to 1.8.1.7. Update Charitable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Business One Page: Missing AuthorizationCVE-2024-37505 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rara Themes Business One Page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business One Page: from n/a through 1.2.9.
- Product
- Business One Page
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Business One Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37483 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
- Product
- The Post Grid
- Affected
- up to 7.7.4
- What to do
- Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
- Product
- The Post Grid
- Affected
- up to 7.7.4
- What to do
- Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37481 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
- Product
- The Post Grid
- Affected
- up to 7.7.4
- What to do
- Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Content Converter: Missing AuthorizationCVE-2024-37477 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Automattic Newspack Content Converter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Content Converter: from n/a through 0.1.5.
- Product
- Newspack Content Converter
- Affected
- up to 0.1.5
- What to do
- Affects up to 0.1.5. Update Newspack Content Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Newsletters: Missing AuthorizationCVE-2024-37475 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newspack Newsletters: from n/a through 2.13.2.
- Product
- Newspack Newsletters
- Affected
- up to 2.13.2
- What to do
- Affects up to 2.13.2. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Woffice Core: Missing AuthorizationCVE-2024-37470 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.
- Product
- Woffice Core
- Affected
- up to 5.4.8
- What to do
- Affects up to 5.4.8. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newsmatic: Missing AuthorizationCVE-2024-37468 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in blazethemes Newsmatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newsmatic: from n/a through 1.3.1.
- Product
- Newsmatic
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Newsmatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024CRM Perks Forms: Missing AuthorizationCVE-2024-37463 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.
- Product
- CRM Perks Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Noptin: Missing AuthorizationCVE-2024-37456 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Noptin Newsletter Noptin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Noptin: from n/a through 3.4.2.
- Product
- Noptin
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ProfileGrid: Missing AuthorizationCVE-2024-37453 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 5.8.7.
- Product
- ProfileGrid
- Affected
- up to 5.8.7
- What to do
- Affects up to 5.8.7. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Defender Security: Missing AuthorizationCVE-2024-37444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through <= 4.7.1.
- Product
- Defender Security
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Job Manager - Resume Manager: Missing AuthorizationCVE-2024-37443 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
- Product
- WP Job Manager - Resume Manager
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Church Admin: Missing AuthorizationCVE-2024-37440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.
- Product
- Church Admin
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Uncanny Toolkit Pro for LearnDash: Missing AuthorizationCVE-2024-37439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0
- Product
- Uncanny Toolkit Pro for LearnDash
- What to do
- Update Uncanny Toolkit Pro for LearnDash to the newest version.
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-37427 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.
- Product
- Timetics
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Missing AuthorizationCVE-2024-37425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37423 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024e2pdf: Missing AuthorizationCVE-2024-37415 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
- Product
- e2pdf
- Affected
- up to 1.20.27
- What to do
- Affects up to 1.20.27. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Progress Planner: Missing AuthorizationCVE-2024-37411 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through <= 0.9.1.
- Product
- Progress Planner
- Affected
- up to 0.9.1
- What to do
- Affects up to 0.9.1. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Paid Memberships Pro: Authorization Bypass Through User-Controlled KeyCVE-2024-37277 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.
- Product
- Paid Memberships Pro
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Featured Image from URL: Missing AuthorizationCVE-2024-37276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.
- Product
- Featured Image from URL
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Featured Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masterstudy Elementor Widgets: Missing AuthorizationCVE-2024-37269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024ElementsKit Elementor addons Lite: Missing AuthorizationCVE-2024-37255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.1.4.
- Product
- ElementsKit Elementor addons Lite
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024File Manager: Missing AuthorizationCVE-2024-37254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.
- Product
- File Manager
- Affected
- up to 7.2.7
- What to do
- Affects up to 7.2.7. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37250 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
- Product
- Advanced Custom Fields PRO
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37249 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
- Product
- Advanced Custom Fields PRO
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Hercules Core: Missing AuthorizationCVE-2024-37232 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Hercules Design Hercules Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hercules Core: from n/a through 6.5.
- Product
- Hercules Core
- Affected
- up to 6.5
- What to do
- Affects up to 6.5. Update Hercules Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Kanban Boards for: Missing AuthorizationCVE-2024-37226 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
- Product
- Kanban Boards for
- Affected
- up to 2.5.21
- What to do
- Affects up to 2.5.21. Update Kanban Boards for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Optinly: Missing AuthorizationCVE-2024-37220 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OptinlyHQ Optinly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optinly: from n/a through 1.0.18.
- Product
- Optinly
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Optinly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Page Builder Sandwich – Front-End Page Builder: Missing AuthorizationCVE-2024-37218 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
- Product
- Page Builder Sandwich – Front-End Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.