Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,276 results · page 56 of 86
Jan 2, 2025Product Recommendation Quiz for eCommerce: Missing AuthorizationCVE-2023-46631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RevenueHunt Product Recommendation Quiz for eCommerce product-recommendation-quiz-for-ecommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Recommendation Quiz for eCommerce: from n/a through <= 2.1.2.
- Product
- Product Recommendation Quiz for eCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Recommendation Quiz for eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Word Count: Missing AuthorizationCVE-2023-46628 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedLettuce Plugins WP Word Count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Word Count: from n/a through 3.2.4.
- Product
- WP Word Count
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update WP Word Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Draw Attention: Missing AuthorizationCVE-2023-46616 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NSquared Draw Attention allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Draw Attention: from n/a through 2.0.15.
- Product
- Draw Attention
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Draw Attention to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Mediabay: Missing AuthorizationCVE-2023-46612 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codedraft Mediabay mediabay-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mediabay: from n/a through <= 1.6.
- Product
- Mediabay
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Mediabay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Quill Forms: Missing AuthorizationCVE-2023-46610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mohamed Magdy Quill Forms quillforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quill Forms: from n/a through <= 3.3.0.
- Product
- Quill Forms
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Quill Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025FeedFocal: Missing AuthorizationCVE-2023-46609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FeedFocal FeedFocal feedfocal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FeedFocal: from n/a through <= 1.2.2.
- Product
- FeedFocal
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update FeedFocal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025DoLogin Security: Missing AuthorizationCVE-2023-46608 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through <= 3.7.1.
- Product
- DoLogin Security
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update DoLogin Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP iCal Availability: Missing AuthorizationCVE-2023-46607 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP iCal Availability WP iCal Availability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP iCal Availability: from n/a through 1.0.3.
- Product
- WP iCal Availability
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP iCal Availability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025AtomChat: Missing AuthorizationCVE-2023-46606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Team AtomChat AtomChat atomchat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AtomChat: from n/a through <= 1.1.4.
- Product
- AtomChat
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Convertful – Your Ultimate On-Site Conversion Tool: Missing AuthorizationCVE-2023-46605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ruslan Suhar Convertful – Your Ultimate On-Site Conversion Tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Convertful – Your Ultimate On-Site Conversion Tool: from n/a through 2.5.
- Product
- Convertful – Your Ultimate On-Site Conversion Tool
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Convertful – Your Ultimate On-Site Conversion Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025wpDiscuz: Missing AuthorizationCVE-2023-46309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.10.
- Product
- wpDiscuz
- Affected
- up to 7.6.10
- What to do
- Affects up to 7.6.10. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025MW WP Form: Missing AuthorizationCVE-2023-46206 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Webの相談所 MW WP Form mw-wp-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MW WP Form: from n/a through <= 4.4.5.
- Product
- MW WP Form
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Just Custom Fields: Missing AuthorizationCVE-2023-46203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2.
- Product
- Just Custom Fields
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Just Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2023-46196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 4.97.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 4.97
- What to do
- Affects up to 4.97. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Headline Analyzer: Missing AuthorizationCVE-2023-46195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headline Analyzer: from n/a through <= 1.3.1.
- Product
- Headline Analyzer
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Headline Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Freesoul Deactivate Plugins – Plugin manager and cleanup: Missing AuthorizationCVE-2023-46188 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins – Plugin manager and cleanup: from n/a through 2.1.3.
- Product
- Freesoul Deactivate Plugins – Plugin manager and cleanup
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Freesoul Deactivate Plugins – Plugin manager and cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-46083 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.27.
- Product
- Kali Forms
- Affected
- up to 2.3.27
- What to do
- Affects up to 2.3.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Broken Link Checker | Finder: Missing AuthorizationCVE-2023-46082 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder broken-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through <= 2.4.2.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025ApplyOnline – Application Form Builder and Manager: Missing AuthorizationCVE-2023-46080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a through 2.5.3.
- Product
- ApplyOnline – Application Form Builder and Manager
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update ApplyOnline – Application Form Builder and Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Ashe Extra: Missing AuthorizationCVE-2023-46079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Royal Ashe Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe Extra: from n/a through 1.2.9.
- Product
- Ashe Extra
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Ashe Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025DX Delete Attached Media: Missing AuthorizationCVE-2023-46073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev DX Delete Attached Media dx-delete-attached-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DX Delete Attached Media: from n/a through <= 2.0.5.1.
- Product
- DX Delete Attached Media
- Affected
- up to 2.0.5.1
- What to do
- Affects up to 2.0.5.1. Update DX Delete Attached Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025RumbleTalk Live Group Chat: Missing AuthorizationCVE-2023-45828 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.
- Product
- RumbleTalk Live Group Chat
- Affected
- up to 6.2.5
- What to do
- Affects up to 6.2.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Poll Maker: Missing AuthorizationCVE-2023-45766 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.7.1.
- Product
- Poll Maker
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP ERP: Missing AuthorizationCVE-2023-45765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.12.6.
- Product
- WP ERP
- Affected
- up to 1.12.6
- What to do
- Affects up to 1.12.6. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025wpDiscuz: Missing AuthorizationCVE-2023-45760 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.3.
- Product
- wpDiscuz
- Affected
- up to 7.6.3
- What to do
- Affects up to 7.6.3. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Appointment Hour Booking: Missing AuthorizationCVE-2023-45649 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople Appointment Hour Booking appointment-hour-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Hour Booking: from n/a through <= 1.4.23.
- Product
- Appointment Hour Booking
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update Appointment Hour Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WordPress Backup & Migration: Missing AuthorizationCVE-2023-45636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through <= 1.4.1.
- Product
- WordPress Backup & Migration
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2023-45631 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
- Product
- Responsive Image Gallery, Gallery Album
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-45275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.28.
- Product
- Kali Forms
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WowStore: Missing AuthorizationCVE-2023-45271 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 2.7.8.
- Product
- WowStore
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update WowStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Bold Timeline Lite: Missing AuthorizationCVE-2023-45110 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Timeline Lite: from n/a through <= 1.1.9.
- Product
- Bold Timeline Lite
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025BetterLinks: Missing AuthorizationCVE-2023-45104 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in WPDeveloper BetterLinks betterlinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through <= 1.6.0.
- Product
- BetterLinks
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Customer Reviews for WooCommerce: Missing AuthorizationCVE-2023-45101 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce customer-reviews-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through <= 5.36.0.
- Product
- Customer Reviews for WooCommerce
- Affected
- up to 5.36.0
- What to do
- Affects up to 5.36.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Job Openings: Missing AuthorizationCVE-2023-45061 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awsm.in WP Job Openings wp-job-openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through <= 3.4.1.
- Product
- WP Job Openings
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update WP Job Openings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Custom Widget area: Missing AuthorizationCVE-2023-45045 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in krozero WP Custom Widget area wp-custom-widget-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Widget area: from n/a through <= 1.2.5.
- Product
- WP Custom Widget area
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Custom Widget area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP User Frontend: Missing AuthorizationCVE-2023-45002 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.
- Product
- WP User Frontend
- Affected
- up to 3.6.8
- What to do
- Affects up to 3.6.8. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP Custom Admin Interface: Missing AuthorizationCVE-2023-44988 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP Custom Admin Interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through 7.32.
- Product
- WP Custom Admin Interface
- Affected
- up to 7.32
- What to do
- Affects up to 7.32. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Schema App Structured Data: Missing AuthorizationCVE-2023-44258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vberkel Schema App Structured Data schema-app-structured-data-for-schemaorg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schema App Structured Data: from n/a through <= 1.23.1.
- Product
- Schema App Structured Data
- Affected
- up to 1.23.1
- What to do
- Affects up to 1.23.1. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Agency Toolkit: Missing AuthorizationCVE-2024-56066 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <= 1.0.23.
- Product
- Agency Toolkit
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Agency Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024RepairBuddy: Missing AuthorizationCVE-2024-56061 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through <= 3.8119.
- Product
- RepairBuddy
- Affected
- up to 3.8119
- What to do
- Affects up to 3.8119. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPLMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-56044 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Contact Form, Survey & Form Builder – MightyForms: Missing AuthorizationCVE-2024-56002 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form, Survey & Form Builder – MightyForms: from n/a through <= 1.3.9.
- Product
- Contact Form, Survey & Form Builder – MightyForms
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Contact Form, Survey & Form Builder – MightyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Torod: Missing AuthorizationCVE-2024-55995 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Torod Company for Information Technology Torod torod allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Torod: from n/a through <= 1.7.
- Product
- Torod
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Torod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Paytium: Missing AuthorizationCVE-2024-51667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10.
- Product
- Paytium
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Best Restaurant Menu by PriceListo: Missing AuthorizationCVE-2024-49698 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto.This issue affects Best Restaurant Menu by PriceListo: from n/a through <= 1.4.2.
- Product
- Best Restaurant Menu by PriceListo
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Best Restaurant Menu by PriceListo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024My Wp Brand: Missing AuthorizationCVE-2024-49694 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in imw3 My Wp Brand my-wp-brand.This issue affects My Wp Brand: from n/a through <= 1.1.2.
- Product
- My Wp Brand
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update My Wp Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Smart Manager: Missing AuthorizationCVE-2024-49687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0.
- Product
- Smart Manager
- Affected
- up to 8.45.0
- What to do
- Affects up to 8.45.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Landing Page Cat: Missing AuthorizationCVE-2024-49686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in fatcatapps Landing Page Cat landing-page-cat.This issue affects Landing Page Cat: from n/a through <= 1.7.4.
- Product
- Landing Page Cat
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Landing Page Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.