Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

561new WordPress flaws this week

398,769entries in the database

24,693 results · page 377 of 494

Jun 11, 2024Tutor LMS: Missing AuthorizationCVE-2023-25799 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.
Product
Tutor LMS
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Sensitive Information ExposureCVE-2024-4266 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
Product
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Blog2Social: Social Media Auto Post & Scheduler: SQL InjectionCVE-2024-3549 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.4.1
What to do
Affects up to 7.4.1. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 11, 2024Advanced Contact form 7 DB: Sensitive Information ExposureCVE-2024-3723 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Product
Advanced Contact form 7 DB
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 11, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-5530 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WL: Product Horizontal Filter widget in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2024Custom Field Template: Sensitive Information ExposureCVE-2023-6748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Ovic Importer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35754 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3.
Product
Ovic Importer
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Ovic Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Under Construction / Maintenance Mode from Acurax: Authentication Bypass by SpoofingCVE-2024-35749 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.
Product
Under Construction / Maintenance Mode from Acurax
Affected
up to 2.6
What to do
Affects up to 2.6. Update Under Construction / Maintenance Mode from Acurax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Contact Form Builder, Contact Widget: Improper Restriction of Excessive Authentication AttemptsCVE-2024-35747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7.
Product
Contact Form Builder, Contact Widget
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Contact Form Builder, Contact Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Strategery Migrations: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35745 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Gabriel Somoza / Joseph Fitzgibbons Strategery Migrations allows Path Traversal, File Manipulation.This issue affects Strategery Migrations: from n/a through 1.0.
Product
Strategery Migrations
Affected
up to 1.0
What to do
Affects up to 1.0. Update Strategery Migrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Upunzipper: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35744 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Manipulation.This issue affects Upunzipper: from n/a through 1.0.0.
Product
Upunzipper
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Upunzipper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024SC filechecker: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35743 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Siteclean SC filechecker allows Path Traversal, File Manipulation.This issue affects SC filechecker: from n/a through 0.6.
Product
SC filechecker
Affected
up to 0.6
What to do
Affects up to 0.6. Update SC filechecker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024PPOM for WooCommerce: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-35728 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Themeisle PPOM for WooCommerce allows Code Inclusion.This issue affects PPOM for WooCommerce: from n/a through 32.0.20.
Product
PPOM for WooCommerce
Affected
up to 32.0.20
What to do
Affects up to 32.0.20. Update PPOM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Database Cleaner: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35712 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This issue affects Database Cleaner: from n/a through 1.0.5.
Product
Database Cleaner
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024YITH WooCommerce Product Add-Ons: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-35680 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.9.2.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024MegaMenu: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35677 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This issue affects MegaMenu: from n/a through 2.3.12.
Product
MegaMenu
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update MegaMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Checkout Field Editor for WooCommerce (Pro): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35658 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File Manipulation.This issue affects Checkout Field Editor for WooCommerce (Pro): from n/a through 3.6.2.
Product
Checkout Field Editor for WooCommerce (Pro)
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Checkout Field Editor for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024MelaPress Login Security: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-35650 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security melapress-login-security.This issue affects MelaPress Login Security: from n/a through <= 1.3.0.
Product
MelaPress Login Security
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Crafthemes Demo Import: Missing AuthorizationCVE-2024-34800 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Crafthemes Crafthemes Demo Import crafthemes-demo-import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crafthemes Demo Import: from n/a through <= 3.3.
Product
Crafthemes Demo Import
Affected
up to 3.3
What to do
Affects up to 3.3. Update Crafthemes Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Netgsm: Missing AuthorizationCVE-2024-4746 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.32.
Product
Netgsm
Affected
up to 2.9.32
What to do
Affects up to 2.9.32. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Giveaways and Contests by RafflePress: Missing AuthorizationCVE-2024-4745 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.
Product
Giveaways and Contests by RafflePress
Affected
up to 1.12.4
What to do
Affects up to 1.12.4. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024iPages Flipbook: Missing AuthorizationCVE-2024-4744 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPages Flipbook.This issue affects iPages Flipbook: from n/a through 1.5.1.
Product
iPages Flipbook
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update iPages Flipbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Easy Forms for Mailchimp: Missing AuthorizationCVE-2024-35742 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Awesome Support: Missing AuthorizationCVE-2024-35741 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
Product
Awesome Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2024-35735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11.
Product
WP Time Slots Booking Form
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Tickera: Missing AuthorizationCVE-2024-35729 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.2.6.
Product
Tickera
Affected
up to 3.5.2.6
What to do
Affects up to 3.5.2.6. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Extra Product Options for WooCommerce: Missing AuthorizationCVE-2024-35727 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6.
Product
Extra Product Options for WooCommerce
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Extra Product Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024WooBuddy: Missing AuthorizationCVE-2024-35726 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.19.
Product
WooBuddy
Affected
up to 3.4.19
What to do
Affects up to 3.4.19. Update WooBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2024-35725 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.6.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Bosa Elementor Addons and Templates for WooCommerce: Missing AuthorizationCVE-2024-35724 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bosa Themes Bosa Elementor Addons and Templates for WooCommerce.This issue affects Bosa Elementor Addons and Templates for WooCommerce: from n/a through 1.0.12.
Product
Bosa Elementor Addons and Templates for WooCommerce
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Bosa Elementor Addons and Templates for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Dashboard To-Do List: Missing AuthorizationCVE-2024-35723 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through <= 1.2.0.
Product
Dashboard To-Do List
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Dashboard To-Do List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: Missing AuthorizationCVE-2024-35722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: Missing AuthorizationCVE-2024-35721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.
Product
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Album Gallery – WordPress Gallery: Missing AuthorizationCVE-2024-35720 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: from n/a through 1.5.7.
Product
Album Gallery – WordPress Gallery
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Album Gallery – WordPress Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: Missing AuthorizationCVE-2024-35717 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.
Product
Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024PilotPress: Missing AuthorizationCVE-2024-23524 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30.
Product
PilotPress
Affected
up to 2.0.30
What to do
Affects up to 2.0.30. Update PilotPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Amelia: Missing AuthorizationCVE-2024-22298 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98.
Product
Amelia
Affected
up to 1.0.98
What to do
Affects up to 1.0.98. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 202412 Step Meeting List: Missing AuthorizationCVE-2024-22296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.28.
Product
12 Step Meeting List
Affected
up to 3.14.28
What to do
Affects up to 3.14.28. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024RabbitLoader: Missing AuthorizationCVE-2024-21751 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RabbitLoader.This issue affects RabbitLoader: from n/a through 2.19.13.
Product
RabbitLoader
Affected
up to 2.19.13
What to do
Affects up to 2.19.13. Update RabbitLoader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WooCommerce Dropshipping: Missing AuthorizationCVE-2024-35748 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OPMC WooCommerce Dropshipping.This issue affects WooCommerce Dropshipping: from n/a through 5.0.4.
Product
WooCommerce Dropshipping
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update WooCommerce Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Simple COD Fees for WooCommerce: Missing AuthorizationCVE-2024-35662 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Andreas Sofantzis Simple COD Fees for WooCommerce.This issue affects Simple COD Fees for WooCommerce: from n/a through 2.0.2.
Product
Simple COD Fees for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Simple COD Fees for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Upload Fields for WPForms: Missing AuthorizationCVE-2024-35661 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
Product
Upload Fields for WPForms
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Upload Fields for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: Missing AuthorizationCVE-2024-34802 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.
Product
AdFoxly – Ad Manager, AdSense Ads & Ads.Txt
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update AdFoxly – Ad Manager, AdSense Ads & Ads.Txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Filter Custom Fields & Taxonomies Light: Missing AuthorizationCVE-2024-32081 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
Product
Filter Custom Fields & Taxonomies Light
Affected
up to 1.05
What to do
Affects up to 1.05. Update Filter Custom Fields & Taxonomies Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WC Marketplace: Missing AuthorizationCVE-2024-31304 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.1.3.
Product
WC Marketplace
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update WC Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024EmbedPress: Missing AuthorizationCVE-2024-31284 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.8.
Product
EmbedPress
Affected
up to 3.9.8
What to do
Affects up to 3.9.8. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Advanced Local Pickup for WooCommerce: Missing AuthorizationCVE-2024-31283 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.2.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Products, Order & Customers Export for WooCommerce: Missing AuthorizationCVE-2024-31276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory Products, Order & Customers Export for WooCommerce.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.8.
Product
Products, Order & Customers Export for WooCommerce
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Products, Order & Customers Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024EventPrime: Missing AuthorizationCVE-2024-31275 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.
Product
EventPrime
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024AI Post Generator | AutoWriter: Missing AuthorizationCVE-2024-32713 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AutoWriter AI Post Generator | AutoWriter.This issue affects AI Post Generator | AutoWriter: from n/a through 3.3.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.