Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,631 results · page 57 of 73
May 8, 2023Sloth Logo Customizer: Does not have CSRF checkCVE-2023-0603 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Sloth Logo Customizer
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Sloth Logo Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Enable/Disable Auto Login when Register: Does not have CSRF check in placeCVE-2023-0522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enable/Disable Auto Login when Register
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Enable/Disable Auto Login when Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.CVE-2023-25967 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.
- Fixed in
- 6.0.3.0
- What to do
- Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.CVE-2023-23790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.
- Fixed in
- 2.9.11
- What to do
- Update the plugin to 2.9.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.CVE-2023-22691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2023WPCode: Has a flawed CSRFCVE-2023-1624 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
- Product
- WPCode
- Fixed in
- 2.0.9
- What to do
- Update WPCode to 2.0.9 or newer.
Apr 24, 2023Custom Post Type UI: Does not properly check for CSRFCVE-2023-1623 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.
- Product
- Custom Post Type UI
- Fixed in
- 1.13.5
- What to do
- Update Custom Post Type UI to 1.13.5 or newer.
Apr 24, 2023WP VR: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2023-1414 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
- Product
- WP VR
- Fixed in
- 8.3.0
- What to do
- Update WP VR to 8.3.0 or newer.
Apr 24, 2023Custom Post Type and Taxonomy GUI Manager: Does not have CSRFCVE-2023-0420 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF
- Product
- Custom Post Type and Taxonomy GUI Manager
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom Post Type and Taxonomy GUI Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.CVE-2023-23879 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.CVE-2023-22686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.CVE-2022-45080 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.CVE-2022-45074 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2023Redirection: Does not have CSRF checks in the uninstall actionCVE-2023-1331 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.
- Product
- Redirection
- Fixed in
- 1.1.5
- What to do
- Update Redirection to 1.1.5 or newer.
Apr 17, 2023Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updCVE-2023-0889 · WordPress plugins & themes · reported by WPScanMedium 6.5
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.CVE-2023-30474 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.CVE-2023-23801 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.
- Fixed in
- 1.0.7
- What to do
- Update the plugin to 1.0.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.CVE-2022-46793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
- Fixed in
- 12.4.5
- What to do
- Update the plugin to 12.4.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versioCVE-2022-41633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.
- Fixed in
- 6.0.3.0
- What to do
- Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 3, 2023User Role by BestWebSoft: Does not protect against CSRF in requests to update role capabilitiesCVE-2023-0820 · WordPress plugins & themes · reported by WPScanHigh 8.8
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
- Product
- User Role by BestWebSoft
- Fixed in
- 1.6.7
- What to do
- Update User Role by BestWebSoft to 1.6.7 or newer.
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.CVE-2023-23861 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin CVE-2022-38077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2023OAuth Single Sign On: Does not have CSRF checksCVE-2023-1093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
- Product
- OAuth Single Sign On
- Fixed in
- 6.24.2
- What to do
- Update OAuth Single Sign On to 6.24.2 or newer.
Mar 27, 2023Coupon Zen: Does not have CSRF checkCVE-2023-1089 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Coupon Zen
- Fixed in
- 1.0.6
- What to do
- Update Coupon Zen to 1.0.6 or newer.
Mar 27, 2023WP Plugin Manager: Does not have CSRF checkCVE-2023-1088 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Plugin Manager
- Fixed in
- 1.1.8
- What to do
- Update WP Plugin Manager to 1.1.8 or newer.
Mar 27, 2023WC Sales Notification: Does not have CSRF checkCVE-2023-1087 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WC Sales Notification
- Fixed in
- 1.2.3
- What to do
- Update WC Sales Notification to 1.2.3 or newer.
Mar 27, 2023Preview Link Generator: Does not have CSRF checkCVE-2023-1086 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Preview Link Generator
- Fixed in
- 1.0.4
- What to do
- Update Preview Link Generator to 1.0.4 or newer.
Mar 27, 2023Ever Compare: Does not have CSRF checkCVE-2023-0505 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Ever Compare
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Ever Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023HT Politic: Does not have CSRF checkCVE-2023-0504 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Politic
- Fixed in
- 2.3.8
- What to do
- Update HT Politic to 2.3.8 or newer.
Mar 27, 2023Free WooCommerce Theme 99fy Extension: Does not have CSRF checkCVE-2023-0503 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Free WooCommerce Theme 99fy Extension
- Fixed in
- 1.2.8
- What to do
- Update Free WooCommerce Theme 99fy Extension to 1.2.8 or newer.
Mar 27, 2023WP News: Does not have CSRF checkCVE-2023-0502 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP News
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update WP News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023WP Insurance: Does not have CSRF checkCVE-2023-0501 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Insurance
- Fixed in
- 2.1.4
- What to do
- Update WP Insurance to 2.1.4 or newer.
Mar 27, 2023WP Film Studio: Does not have CSRF checkCVE-2023-0500 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Film Studio
- Fixed in
- 1.3.5
- What to do
- Update WP Film Studio to 1.3.5 or newer.
Mar 27, 2023QuickSwish: Does not have CSRF checkCVE-2023-0499 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- QuickSwish
- Fixed in
- 1.1.0
- What to do
- Update QuickSwish to 1.1.0 or newer.
Mar 27, 2023WP Education: Does not have CSRF checkCVE-2023-0498 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Education
- Fixed in
- 1.2.7
- What to do
- Update WP Education to 1.2.7 or newer.
Mar 27, 2023HT Portfolio: Does not have CSRF checkCVE-2023-0497 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Portfolio
- Fixed in
- 1.1.6
- What to do
- Update HT Portfolio to 1.1.6 or newer.
Mar 27, 2023HT Event: Does not have CSRF checkCVE-2023-0496 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Event
- Fixed in
- 1.4.6
- What to do
- Update HT Event to 1.4.6 or newer.
Mar 27, 2023HT Slider For Elementor: Does not have CSRF checkCVE-2023-0495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Slider For Elementor
- Fixed in
- 1.4.0
- What to do
- Update HT Slider For Elementor to 1.4.0 or newer.
Mar 27, 2023Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks: Does not have CSRF checkCVE-2023-0484 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Fixed in
- 1.1.6
- What to do
- Update Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks to 1.1.6 or newer.
Mar 27, 2023OoohBoi Steroids for Elementor: Has CSRF and broken access control vulnerabilitiesCVE-2023-0336 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.
- Product
- OoohBoi Steroids for Elementor
- Fixed in
- 2.1.5
- What to do
- Update OoohBoi Steroids for Elementor to 2.1.5 or newer.
Mar 27, 2023WP Shamsi: Has CSRF and broken access control vulnerabilitiesCVE-2023-0335 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
- Product
- WP Shamsi
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update WP Shamsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.CVE-2022-30705 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.
- Fixed in
- 2.35.1.3.0
- What to do
- Update the plugin to 2.35.1.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023WP OAuth Server (OAuth Authentication): Has a flawed CSRF and authorisation checkCVE-2022-4148 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.3.0
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.3.0 or newer.
Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.5
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.5 or newer.
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.CVE-2023-23721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.
- Affected
- up to 1.50
- What to do
- Affects up to 1.50. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.CVE-2023-22678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.CVE-2023-22681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <= 2.1.0 version.CVE-2022-46867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <= 2.1.0 version.
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions.CVE-2022-46854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions.
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.CVE-2022-38063 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.
- Affected
- up to 5.0.0.0
- What to do
- Affects up to 5.0.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.