Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,657 results · page 54 of 94

Sep 25, 2024GiveWP: Cross-Site Request Forgery (CSRF)CVE-2024-47315 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1.
Product
GiveWP
Affected
up to 3.15.1
What to do
Affects up to 3.15.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2024Use Any Font: Cross-Site Request Forgery (CSRF)CVE-2024-47305 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font use-any-font allows Cross Site Request Forgery.This issue affects Use Any Font: from n/a through <= 6.3.08.
Product
Use Any Font
Affected
up to 6.3.08
What to do
Affects up to 6.3.08. Update Use Any Font to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 24, 2024Easy PayPal Events: Cross-Site Request ForgeryCVE-2024-8476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy PayPal Events
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Easy PayPal Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024Premium Packages – Sell Digital Products Securely: Cross-Site Request ForgeryCVE-2024-7386 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for unauthenticated attackers to perform actions such as initiating refunds via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 23, 2024BA Book Everything: Cross-Site Request ForgeryCVE-2024-8795 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's account details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to reset a user's password and gain access to their account.
Product
BA Book Everything
Affected
up to 1.6.20
What to do
Affects up to 1.6.20. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2024Justified Image Grid: Server-Side Request Forgery (SSRF)CVE-2024-43989 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <= 4.6.1.
Product
Justified Image Grid
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Justified Image Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024PropertyHive: Cross-Site Request ForgeryCVE-2024-8490 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
PropertyHive
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Stream: Cross-Site Request ForgeryCVE-2024-7423 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Stream
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
MM-Breaking News
Affected
up to 0.7.9
What to do
Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not sanitise and escape incoming music requestsCVE-2024-6019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not have CSRF check in some placesCVE-2024-6017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 10, 2024Tutor LMS: Cross-Site Request ForgeryCVE-2023-2919 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Tutor LMS
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2024WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature.CVE-2024-45270 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
Fixed in
2.2.4
What to do
Update the plugin to 2.2.4 or newer.
Full record and what to do →NVD record github.com jvn.jp
Sep 1, 2024WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature.CVE-2024-45269 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
Fixed in
2.0
What to do
Update the plugin to 2.0 or newer.
Full record and what to do →NVD record github.com jvn.jp
Aug 30, 2024Tourfic: Cross-Site Request ForgeryCVE-2024-8319 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions. This makes it possible for unauthenticated attackers to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Tourfic
Affected
up to 2.11.20
What to do
Affects up to 2.11.20. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2024WP Armour Extended: Cross-Site Request Forgery (CSRF)CVE-2024-43947 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.
Product
WP Armour Extended
Affected
up to 1.26
What to do
Affects up to 1.26. Update WP Armour Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Cross-Site Request ForgeryCVE-2024-8200 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'update_api_key' function. This makes it possible for unauthenticated attackers to update an API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2024oik: Cross-Site Request Forgery (CSRF)CVE-2024-43356 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0.
Product
oik
Affected
up to 4.12.0
What to do
Affects up to 4.12.0. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Advanced Form Integration: Cross-Site Request Forgery (CSRF)CVE-2024-43340 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.
Product
Advanced Form Integration
Affected
up to 1.89.4
What to do
Affects up to 1.89.4. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024WebinarPress: Cross-Site Request Forgery (CSRF)CVE-2024-43339 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.
Product
WebinarPress
Affected
up to 1.33.20
What to do
Affects up to 1.33.20. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Brave Popup Builder: Cross-Site Request Forgery (CSRF)CVE-2024-43337 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.
Product
Brave Popup Builder
Affected
up to 0.7.0
What to do
Affects up to 0.7.0. Update Brave Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024WP User Manager: Cross-Site Request Forgery (CSRF)CVE-2024-43336 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9.10.
Product
WP User Manager
Affected
up to 2.9.10
What to do
Affects up to 2.9.10. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Dark Mode for WP Dashboard: Cross-Site Request Forgery (CSRF)CVE-2024-43325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.
Product
Dark Mode for WP Dashboard
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dark Mode for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Stripe Payments For WooCommerce by Checkout: Cross-Site Request Forgery (CSRF)CVE-2024-43316 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
Product
Stripe Payments For WooCommerce by Checkout
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Fonts: Cross-Site Request Forgery (CSRF)CVE-2024-43301 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7.
Product
Fonts
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024SpeedyCache: Cross-Site Request Forgery (CSRF)CVE-2024-43299 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8.
Product
SpeedyCache
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update SpeedyCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024WP Data Access: Cross-Site Request Forgery (CSRF)CVE-2024-43295 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7.
Product
WP Data Access
Affected
up to 5.5.7
What to do
Affects up to 5.5.7. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Cross-Site Request Forgery (CSRF)CVE-2024-43287 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Affected
up to 3.1.82
What to do
Affects up to 3.1.82. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Backup and Restore: Cross-Site Request Forgery (CSRF)CVE-2024-43269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1.50.
Product
Backup and Restore
Affected
up to 1.50
What to do
Affects up to 1.50. Update Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Analytify: Cross-Site Request Forgery (CSRF)CVE-2024-43265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1.
Product
Analytify
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Hummingbird: Cross-Site Request Forgery (CSRF)CVE-2024-43117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.
Product
Hummingbird
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Simple Local Avatars: Cross-Site Request Forgery (CSRF)CVE-2024-43116 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.
Product
Simple Local Avatars
Affected
up to 2.7.10
What to do
Affects up to 2.7.10. Update Simple Local Avatars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-39657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
Product
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Affected
up to 2.6.18
What to do
Affects up to 2.6.18. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Tutor LMS: Cross-Site Request Forgery (CSRF)CVE-2024-39645 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
Product
Tutor LMS
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024LearnPress: Cross-Site Request Forgery (CSRF)CVE-2024-39641 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.
Product
LearnPress
Affected
up to 4.2.6.8.2
What to do
Affects up to 4.2.6.8.2. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2024-39628 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
Product
Ninja Forms
Affected
up to 3.8.6
What to do
Affects up to 3.8.6. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2024ImageRecycle pdf & image compression: Cross-Site Request ForgeryCVE-2024-8120 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2024Favicon Generator: Cross-Site Request ForgeryCVE-2024-7568 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. CVE-2024-7864 appears to be a duplicate of this issue.
Product
Favicon Generator
Affected
up to 1.5
What to do
Affects up to 1.5. Update Favicon Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024OTA Sync Booking Engine Widget: Cross-Site Request ForgeryCVE-2024-7647 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing or incorrect nonce validation on the otasync_widget_settings_fnc() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
OTA Sync Booking Engine Widget
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update OTA Sync Booking Engine Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024BP Profile Search: Cross-Site Request ForgeryCVE-2024-7850 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bps_ajax_field_selector(), bps_ajax_template_options(), and bps_ajax_field_row() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BP Profile Search
Affected
up to 5.7.5
What to do
Affects up to 5.7.5. Update BP Profile Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Bricks: Cross-Site Request ForgeryCVE-2023-3409 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'reset_settings' function. This makes it possible for unauthenticated attackers to reset the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bricks
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bricksbuilder.io wordfence.com
Aug 17, 2024Bricks: Cross-Site Request ForgeryCVE-2023-3408 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'save_settings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including enabling a setting which allows lower-privileged users such as contributors to perform code execution, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bricks
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bricksbuilder.io wordfence.com
Aug 17, 2024Short URL: Cross-Site Request ForgeryCVE-2023-1604 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configuration_page function. This makes it possible for unauthenticated attackers to add and import redirects, including comments containing cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Short URL
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 17, 2024Skitter Slideshow: Server-Side Request ForgeryCVE-2022-1751 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Skitter Slideshow
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Skitter Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org securityforeveryone.com
Aug 16, 2024Download Plugins and Themes in ZIP from Dashboard: Cross-Site Request ForgeryCVE-2024-7501 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This makes it possible for unauthenticated attackers to download arbitrary themes from the website via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. In versions prior to 1.8.6 it was possible to download the entire sites files.
Product
Download Plugins and Themes in ZIP from Dashboard
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2024Theme My Login: Cross-Site Request ForgeryCVE-2024-7422 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances.
Product
Theme My Login
Affected
up to 7.1.7
What to do
Affects up to 7.1.7. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 14, 2024Insert PHP Code Snippet: Cross-Site Request ForgeryCVE-2024-7420 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactivate and delete code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-43275 appears to be a duplicate of this issue.
Product
Insert PHP Code Snippet
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Insert PHP Code Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024Contact Form 7 Summary and Print: Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Muhammad Rehman Contact Form 7 Summary and Print allows Stored XSS.This issue affects Contact Form 7 Summary and Print: from n/a through 1.2.5.
Product
Contact Form 7 Summary and Print
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Contact Form 7 Summary and Print to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Christmasify!: Cross-Site Request ForgeryCVE-2024-7574 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Christmasify!
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Christmasify! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.