Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,660 results · page 344 of 494
Nov 1, 2024Ali2Woo Lite: Missing AuthorizationCVE-2024-37214 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
- Product
- Ali2Woo Lite
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ali2Woo Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Demo Awesome: Missing AuthorizationCVE-2024-37207 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2.
- Product
- Demo Awesome
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024PropertyHive: Missing AuthorizationCVE-2024-37204 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9.
- Product
- PropertyHive
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Laybuy Payment Extension for WooCommerce: Missing AuthorizationCVE-2024-37203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.
- Product
- Laybuy Payment Extension for WooCommerce
- Affected
- up to 5.3.9
- What to do
- Affects up to 5.3.9. Update Laybuy Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Woocommerce Customers Order History: Missing AuthorizationCVE-2024-37201 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2.
- Product
- Woocommerce Customers Order History
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update Woocommerce Customers Order History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Ibtana: Missing AuthorizationCVE-2024-37123 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3.
- Product
- Ibtana
- Affected
- up to 1.2.3.3
- What to do
- Affects up to 1.2.3.3. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Uncanny Automator Pro: Missing AuthorizationCVE-2024-37119 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator Pro: from n/a through 5.3.0.0.
- Product
- Uncanny Automator Pro
- Affected
- up to 5.3.0.0
- What to do
- Affects up to 5.3.0.0. Update Uncanny Automator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37108 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Missing AuthorizationCVE-2024-37106 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Popup box: Missing AuthorizationCVE-2024-37096 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Popup Box Team Popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup box: from n/a through 4.5.1.
- Product
- Popup box
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-37095 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.7.3.
- Product
- Envira Photo Gallery
- Affected
- up to 1.8.7.3
- What to do
- Affects up to 1.8.7.3. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024MasterStudy LMS: Missing AuthorizationCVE-2024-37094 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
- Product
- MasterStudy LMS
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Multiple Page Generator Plugin – MPG: Unauthorized modification of and access to dataCVE-2024-7424 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.
- Product
- Multiple Page Generator Plugin – MPG
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2024SIP Reviews Shortcode for WooCommerce: SQL InjectionCVE-2024-6479 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'no_of_reviews' attribute in the woocommerce_reviews shortcode in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- SIP Reviews Shortcode for WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update SIP Reviews Shortcode for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2024WPMobile.App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43933 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This issue affects WPMobile.App: from n/a through <= 11.48.
- Product
- WPMobile.App
- Affected
- up to 11.48
- What to do
- Affects up to 11.48. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2024WPGlobus Translate Options: Cross-Site Request ForgeryCVE-2024-9434 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the on__translate_options_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts and update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WPGlobus Translate Options
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update WPGlobus Translate Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 30, 2024Woo Manage Fraud Orders: Sensitive Information ExposureCVE-2024-10544 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
- Product
- Woo Manage Fraud Orders
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Woo Manage Fraud Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 30, 2024Greenshift: Incorrect AuthorizationCVE-2024-50419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through <= 9.7.
- Product
- Greenshift
- Affected
- up to 9.7
- What to do
- Affects up to 9.7. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024W3SPEEDSTER: Remote Code ExecutionCVE-2024-8512 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- W3SPEEDSTER
- Affected
- up to 7.26
- What to do
- Affects up to 7.26. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2024Posti Shipping: Generation of Error Message Containing Sensitive InformationCVE-2024-50512 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This issue affects Posti Shipping: from n/a through <= 3.10.2.
- Product
- Posti Shipping
- Affected
- up to 3.10.2
- What to do
- Affects up to 3.10.2. Update Posti Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50509 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50508 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024DS.DownloadList: Deserialization of Untrusted DataCVE-2024-50507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a through <= 1.3.
- Product
- DS.DownloadList
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update DS.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Marketing Automation by AZEXO: Incorrect Privilege AssignmentCVE-2024-50506 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
- Product
- Marketing Automation by AZEXO
- Affected
- up to 1.27.80
- What to do
- Affects up to 1.27.80. Update Marketing Automation by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024User Toolkit: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3.
- Product
- User Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update User Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.
- Product
- Download Monitor
- Affected
- up to 5.0.13
- What to do
- Affects up to 5.0.13. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024The Enable Shortcodes inside Widgets,Comments and Experts: Arbitrary shortcode executionCVE-2024-9846 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Enable Shortcodes inside Widgets,Comments and Experts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update The Enable Shortcodes inside Widgets,Comments and Experts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50454 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Multi Step Form: Missing AuthorizationCVE-2024-50428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.
- Product
- Multi Step Form
- Affected
- up to 1.7.21
- What to do
- Affects up to 1.7.21. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WP Booking System: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through <= 2.0.19.10.
- Product
- WP Booking System
- Affected
- up to 2.0.19.10
- What to do
- Affects up to 2.0.19.10. Update WP Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
- Product
- Templately
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Templately: Missing AuthorizationCVE-2024-50423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
- Product
- Templately
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Templately to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Breeze: Missing AuthorizationCVE-2024-50422 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
- Product
- Breeze
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2024-50421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 3.8.6.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50456 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50455 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
- Product
- SEOPress
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Crypto: Authentication bypassCVE-2024-9989 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Crypto
- Affected
- up to 2.18
- What to do
- Affects up to 2.18. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024Crypto: Authentication bypassCVE-2024-9988 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Crypto
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024AidWP: Missing AuthorizationCVE-2024-50459 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AidWP: from n/a through <= 3.2.3.
- Product
- AidWP
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update AidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024BP Member Type Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager allows Reflected XSS.This issue affects BP Member Type Manager: from n/a through <= 1.01.
- Product
- BP Member Type Manager
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update BP Member Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024CWD 3D Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery allows Reflection Injection.This issue affects CWD 3D Image Gallery: from n/a through <= 1.0.
- Product
- CWD 3D Image Gallery
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CWD 3D Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024WP ERP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP ERP erp allows Reflected XSS.This issue affects WP ERP: from n/a through <= 1.13.2.
- Product
- WP ERP
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Affiliate Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilias Gomatos Affiliate Platform smdp-affiliate-platform allows Reflected XSS.This issue affects Affiliate Platform: from n/a through <= 1.4.8.
- Product
- Affiliate Platform
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Whitelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment Whitelist fifthsegment-whitelist allows Reflected XSS.This issue affects Whitelist: from n/a through <= 3.5.
- Product
- Whitelist
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Whitelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Tida URL Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tidaweb Tida URL Screenshot tida-url-screenshot allows Reflected XSS.This issue affects Tida URL Screenshot: from n/a through <= 1.0.1.
- Product
- Tida URL Screenshot
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Tida URL Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024ACL Floating Cart for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmaderCode Lab ACL Floating Cart for WooCommerce acl-floating-cart-for-woocommerce allows Reflected XSS.This issue affects ACL Floating Cart for WooCommerce: from n/a through <= 0.9.
- Product
- ACL Floating Cart for WooCommerce
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update ACL Floating Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Monitor.chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49639 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Stoever Monitor.chat monitor-chat allows Reflected XSS.This issue affects Monitor.chat: from n/a through <= 1.1.1.
- Product
- Monitor.chat
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Monitor.chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Risk Warning Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ventureharbour Risk Warning Bar risk-warning-bar allows Reflected XSS.This issue affects Risk Warning Bar: from n/a through <= 1.0.
- Product
- Risk Warning Bar
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Risk Warning Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Bet WC 2018 Russia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Bet WC 2018 Russia bet-wc-2018-russia allows Reflected XSS.This issue affects Bet WC 2018 Russia: from n/a through <= 2.1.
- Product
- Bet WC 2018 Russia
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Bet WC 2018 Russia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Agile Video Player Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woracal Agile Video Player Lite agile-video-player allows Reflected XSS.This issue affects Agile Video Player Lite: from n/a through <= 1.0.
- Product
- Agile Video Player Lite
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Agile Video Player Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.