Vulnerability database

4,221 results · page 46 of 85

• Nov 20, 2024Post Ideas: Cross-Site Request Forgery (CSRF)CVE-2024-52451 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in aaronrobbins Post Ideas post-ideas allows SQL Injection.This issue affects Post Ideas: from n/a through <= 2.

  Product

  Post Ideas

  Affected

  up to 2

  What to do

  Affects up to 2. Update Post Ideas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 20, 2024Buying Buddy IDX CRM: Cross-Site Request Forgery (CSRF)CVE-2024-52446 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through <= 1.2.8.

  Product

  Buying Buddy IDX CRM

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024W3SPEEDSTER: Cross-Site Request Forgery (CSRF)CVE-2024-52392 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp.This issue affects W3SPEEDSTER: from n/a through <= 7.25.

  Product

  W3SPEEDSTER

  Affected

  up to 7.25

  What to do

  Affects up to 7.25. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Dynamic Widgets: Cross-Site Request Forgery (CSRF)CVE-2024-51669 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through <= 1.6.4.

  Product

  Dynamic Widgets

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ARMember: Cross-Site Request Forgery (CSRF)CVE-2022-47424 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.

  Product

  ARMember

  Affected

  up to 4.0.5

  Fixed in

  6.7.1

  What to do

  Update ARMember to 6.7.1 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WP Popup Window Maker: Cross-Site Request Forgery (CSRF)CVE-2024-52421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through <= 2.0.

  Product

  WP Popup Window Maker

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Popup Window Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Disable Admin Notices individually: Cross-Site Request Forgery (CSRF)CVE-2024-52420 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.

  Product

  Disable Admin Notices individually

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Disable Admin Notices individually to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Exclusive Content Password Protect: Cross-Site Request Forgery (CSRF)CVE-2024-52402 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in gunghoinc Exclusive Content Password Protect exclusive-content-password-protect allows Upload a Web Shell to a Web Server.This issue affects Exclusive Content Password Protect: from n/a through <= 1.1.0.

  Product

  Exclusive Content Password Protect

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Exclusive Content Password Protect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Hacklog DownloadManager: Cross-Site Request Forgery (CSRF)CVE-2024-52401 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through <= 2.1.4.

  Product

  Hacklog DownloadManager

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Hacklog DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Hebrew Date: Cross-Site Request Forgery (CSRF)CVE-2024-52388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mikeage Hebrew Date hebrewdates allows Stored XSS.This issue affects Hebrew Date: from n/a through <= 2.1.0.

  Product

  Hebrew Date

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Hebrew Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Manage User Columns: Cross-Site Request Forgery (CSRF)CVE-2024-51686 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Deepak Khokhar Manage User Columns manage-user-columns allows Cross Site Request Forgery.This issue affects Manage User Columns: from n/a through <= 1.0.5.

  Product

  Manage User Columns

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Manage User Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024SmartLink Dynamic URLs: Cross-Site Request Forgery (CSRF)CVE-2024-51657 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through <= 1.1.0.

  Product

  SmartLink Dynamic URLs

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update SmartLink Dynamic URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Flash Show And Hide Box: Cross-Site Request Forgery (CSRF)CVE-2024-51656 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in litefeel Flash Show And Hide Box flash-show-and-hide-box allows Stored XSS.This issue affects Flash Show And Hide Box: from n/a through <= 1.6.

  Product

  Flash Show And Hide Box

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Flash Show And Hide Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Custom Author URL: Cross-Site Request Forgery (CSRF)CVE-2024-51655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in microkid Custom Author URL author-slug allows Stored XSS.This issue affects Custom Author URL: from n/a through <= 2.0.1.

  Product

  Custom Author URL

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Custom Author URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024APK Downloader: Cross-Site Request Forgery (CSRF)CVE-2024-51654 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Eric Allen APK Downloader apk-downloader allows Stored XSS.This issue affects APK Downloader: from n/a through <= 1.0.0.

  Product

  APK Downloader

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update APK Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024UPDATE NOTIFICATIONS: Cross-Site Request Forgery (CSRF)CVE-2024-51653 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in akira1891 UPDATE NOTIFICATIONS update-notifications allows Stored XSS.This issue affects UPDATE NOTIFICATIONS: from n/a through <= 0.3.4.

  Product

  UPDATE NOTIFICATIONS

  Affected

  up to 0.3.4

  What to do

  Affects up to 0.3.4. Update UPDATE NOTIFICATIONS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Skip To: Cross-Site Request Forgery (CSRF)CVE-2024-51652 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in marckocher Skip To skip-to allows Stored XSS.This issue affects Skip To: from n/a through <= 2.0.0.

  Product

  Skip To

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Skip To to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Random Featured Post: Cross-Site Request Forgery (CSRF)CVE-2024-51650 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scottmydollarplancom Random Featured Post random-featured-post-plugin allows Stored XSS.This issue affects Random Featured Post: from n/a through <= 1.1.3.

  Product

  Random Featured Post

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Random Featured Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Mobilize: Cross-Site Request Forgery (CSRF)CVE-2024-51649 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Patrick Lumumba Mobilize mobilize allows Stored XSS.This issue affects Mobilize: from n/a through <= 3.0.7.

  Product

  Mobilize

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Mobilize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024e-shops: Cross-Site Request Forgery (CSRF)CVE-2024-51648 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hands01 e-shops e-shops-cart2 allows Reflected XSS.This issue affects e-shops: from n/a through <= 1.0.3.

  Product

  e-shops

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update e-shops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ThemeFuse Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2024-51645 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in themefusecom ThemeFuse Maintenance Mode themefuse-maintenance-mode allows Stored XSS.This issue affects ThemeFuse Maintenance Mode: from n/a through <= 1.1.3.

  Product

  ThemeFuse Maintenance Mode

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update ThemeFuse Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Addressbook: Cross-Site Request Forgery (CSRF)CVE-2024-51644 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in samwilson Addressbook addressbook allows Stored XSS.This issue affects Addressbook: from n/a through <= 1.1.3.

  Product

  Addressbook

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Addressbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Amazon Associate Filter: Cross-Site Request Forgery (CSRF)CVE-2024-51643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ragaskar Amazon Associate Filter amazon-associate-filter allows Stored XSS.This issue affects Amazon Associate Filter: from n/a through <= 0.4.

  Product

  Amazon Associate Filter

  Affected

  up to 0.4

  What to do

  Affects up to 0.4. Update Amazon Associate Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Seo Free: Cross-Site Request Forgery (CSRF)CVE-2024-51642 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivan9146 Seo Free seo-free allows Stored XSS.This issue affects Seo Free: from n/a through <= 1.4.

  Product

  Seo Free

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Seo Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Advanced PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2024-51641 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Juan Camilo Advanced PDF Generator advanced-pdf-generator allows Stored XSS.This issue affects Advanced PDF Generator: from n/a through <= 0.4.0.

  Product

  Advanced PDF Generator

  Affected

  up to 0.4.0

  What to do

  Affects up to 0.4.0. Update Advanced PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024MDR Webmaster Tools: Cross-Site Request Forgery (CSRF)CVE-2024-51640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through <= 1.1.

  Product

  MDR Webmaster Tools

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update MDR Webmaster Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Naver Blog: Cross-Site Request Forgery (CSRF)CVE-2024-51639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Hints Naver Blog naver-blog-api allows Stored XSS.This issue affects Naver Blog: from n/a through <= 1.0.

  Product

  Naver Blog

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Naver Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Awesome Shortcodes For Genesis: Cross-Site Request Forgery (CSRF)CVE-2024-51638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Awesome Shortcodes For Genesis awesome-shortcodes-for-genesis allows Stored XSS.This issue affects Awesome Shortcodes For Genesis: from n/a through 1.1.8.

  Product

  Awesome Shortcodes For Genesis

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Awesome Shortcodes For Genesis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Admin SMS Alert: Cross-Site Request Forgery (CSRF)CVE-2024-51637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sroyalty Admin SMS Alert admin-sms-alert allows Stored XSS.This issue affects Admin SMS Alert: from n/a through <= 1.1.0.

  Product

  Admin SMS Alert

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Admin SMS Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024GMO Social Connection: Cross-Site Request Forgery (CSRF)CVE-2024-51636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Z.com byGMO GMO Social Connection gmo-social-connection allows Cross-Site Scripting (XSS).This issue affects GMO Social Connection: from n/a through <= 1.2.

  Product

  GMO Social Connection

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update GMO Social Connection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024While Loading: Cross-Site Request Forgery (CSRF)CVE-2024-51635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Garmur While Loading while-it-is-loading allows Stored XSS.This issue affects While Loading: from n/a through <= 3.0.

  Product

  While Loading

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update While Loading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Webriti Custom Login: Cross-Site Request Forgery (CSRF)CVE-2024-51634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Webriti Custom Login webriti-custom-login-page allows Reflected XSS.This issue affects Webriti Custom Login: from n/a through <= 0.3.

  Product

  Webriti Custom Login

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Webriti Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Simple Page Specific Sidebars: Cross-Site Request Forgery (CSRF)CVE-2024-51633 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivycat Simple Page Specific Sidebars page-specific-sidebars allows Stored XSS.This issue affects Simple Page Specific Sidebars: from n/a through <= 2.14.1.

  Product

  Simple Page Specific Sidebars

  Affected

  up to 2.14.1

  What to do

  Affects up to 2.14.1. Update Simple Page Specific Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024SH Slideshow: Cross-Site Request Forgery (CSRF)CVE-2024-51632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sam Hoe SH Slideshow sh-slideshow allows Stored XSS.This issue affects SH Slideshow: from n/a through <= 4.3.

  Product

  SH Slideshow

  Affected

  up to 4.3

  What to do

  Affects up to 4.3. Update SH Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Sticky Social Bar: Cross-Site Request Forgery (CSRF)CVE-2024-51631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Md Eftakhairul Islam Sticky Social Bar sticky-social-bar allows Cross Site Request Forgery.This issue affects Sticky Social Bar: from n/a through <= 2.0.

  Product

  Sticky Social Bar

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Sticky Social Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024World Prayer Time: Cross-Site Request Forgery (CSRF)CVE-2024-50534 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in techdabang World Prayer Time world-prayer-time allows Stored XSS.This issue affects World Prayer Time: from n/a through <= 2.0.

  Product

  World Prayer Time

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update World Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Domain Sharding: Cross-Site Request Forgery (CSRF)CVE-2024-50533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Garcia Domain Sharding domain-sharding allows Stored XSS.This issue affects Domain Sharding: from n/a through <= 1.2.1.

  Product

  Domain Sharding

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Domain Sharding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.

  Product

  Crowdsignal Dashboard – Polls, Surveys & more

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024wp-login customizer: Cross-Site Request Forgery (CSRF)CVE-2024-52424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through <= 1.0.

  Product

  wp-login customizer

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update wp-login customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 16, 2024SK WP Settings Backup: Cross-Site Request Forgery (CSRF)CVE-2024-52415 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in skipstorm SK WP Settings Backup sk-wp-settings-backup allows Object Injection.This issue affects SK WP Settings Backup: from n/a through <= 1.0.

  Product

  SK WP Settings Backup

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update SK WP Settings Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 15, 2024EleForms – All In One Form Integration including DB for Elementor: Cross-Site Request ForgeryCVE-2024-6628 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.9.9. This is due to missing or incorrect nonce validation when deleting form submissions. This makes it possible for unauthenticated attackers to delete form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  EleForms – All In One Form Integration including DB for Elementor

  Affected

  up to 2.9.9.9

  What to do

  Affects up to 2.9.9.9. Update EleForms – All In One Form Integration including DB for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Nov 15, 2024404 Error Monitor: Cross-Site Request ForgeryCVE-2024-11118 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the updatePluginSettings() function. This makes it possible for unauthenticated attackers to make changes to plugin settings and clear up all the error logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  404 Error Monitor

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update 404 Error Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 14, 2024Appointmind: Cross-Site Request Forgery (CSRF)CVE-2024-51679 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue affects Appointmind: from n/a through <= 4.0.0.

  Product

  Appointmind

  Affected

  up to 4.0.0

  What to do

  Affects up to 4.0.0. Update Appointmind to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024Twitter @Anywhere Plus: Cross-Site Request Forgery (CSRF)CVE-2024-51659 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus twitter-anywhere-plus allows Stored XSS.This issue affects Twitter @Anywhere Plus: from n/a through <= 2.0.

  Product

  Twitter @Anywhere Plus

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Twitter @Anywhere Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024WP Course Manager: Cross-Site Request Forgery (CSRF)CVE-2024-51658 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through <= 1.3.

  Product

  WP Course Manager

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WP Course Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024Platform.ly Official: Cross-Site Request Forgery (CSRF)CVE-2024-51687 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Platform.ly Platform.ly Official platformly allows Stored XSS.This issue affects Platform.ly Official: from n/a through <= 1.1.3.

  Product

  Platform.ly Official

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Platform.ly Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024W3P SEO: Cross-Site Request Forgery (CSRF)CVE-2024-51684 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through < 1.8.6.

  Product

  W3P SEO

  What to do

  Update W3P SEO to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024FraudLabs Pro SMS Verification: Cross-Site Request Forgery (CSRF)CVE-2024-51688 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through <= 1.10.1.

  Product

  FraudLabs Pro SMS Verification

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update FraudLabs Pro SMS Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 12, 2024Kognetiks Chatbot for: Cross-Site Request ForgeryCVE-2024-11143 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. This makes it possible for unauthenticated attackers to modify assistants via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Kognetiks Chatbot for

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 12, 2024WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Cross-Site Request ForgeryCVE-2024-10593 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce validation on the process_admin_ui function. This makes it possible for unauthenticated attackers to delete WPForm logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

  Affected

  up to 1.9.1.6

  What to do

  Affects up to 1.9.1.6. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.