Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
596 results · page 6 of 12
Sep 17, 2024Vikinghammer Tweet: Does not have CSRF check in some placesCVE-2024-8043 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Vikinghammer Tweet
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Vikinghammer Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Lucas String Replace: Reflected Cross-Site ScriptingCVE-2024-8734 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Lucas String Replace
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Lucas String Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 12, 2024MM-Breaking News: Does not have CSRF check in some placesCVE-2024-8054 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- MM-Breaking News
- Affected
- up to 0.7.9
- What to do
- Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024blogintroduction-wordpress-plugin: Does not have CSRF check in placeCVE-2024-7862 · WordPress plugins & themes · reported by WPScanMedium 6.5
The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- blogintroduction-wordpress-plugin
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update blogintroduction-wordpress-plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Paypal: Does not have CSRF check in some placesCVE-2024-7861 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Paypal
- Affected
- up to 1.1.20090324
- What to do
- Affects up to 1.1.20090324. Update Misiek Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Simple Headline Rotator: Does not have CSRF check in some placesCVE-2024-7860 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Simple Headline Rotator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Headline Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Visual Sound: Does not have CSRF check in placeCVE-2024-7859 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update Visual Sound to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Quick Code: Does not have CSRF check in some placesCVE-2024-7822 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Quick Code
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Quick Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024ILC Thickbox: Does not have CSRF check in placeCVE-2024-7820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ILC Thickbox
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update ILC Thickbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF check in some placesCVE-2024-7818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF checks in some placesCVE-2024-7817 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Gixaw Chat: Does not have CSRF check in some placesCVE-2024-7816 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Gixaw Chat
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Gixaw Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Music Request Manager: Does not have CSRF check in some placesCVE-2024-6017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024Snapshot Backup: Does not have CSRF check in some placesCVE-2024-7689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Snapshot Backup
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Snapshot Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF checks in some placesCVE-2024-7688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF check in some placesCVE-2024-7687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024TrueBooker: Does not have CSRF check in placeCVE-2024-6925 · WordPress plugins & themes · reported by WPScanMedium 4.3
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6856 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6852 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 4, 2024MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution: Privilege escalation/de-escalation and account takeoverCVE-2024-8289 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_item_permissions_check functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticated attackers to change the password of any user with the vendor role, create new users with the vendor role, and demote other users like administrators to the vendor role.
- Product
- MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 2, 2024DN Popup: Does not have CSRF check in placeCVE-2024-7690 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Popup
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update DN Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024WC Marketplace: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43213 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Reflected XSS.This issue affects WC Marketplace: from n/a through 4.1.17.
- Product
- WC Marketplace
- Affected
- up to 4.1.17
- What to do
- Affects up to 4.1.17. Update WC Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024wp-cart-for-digital-products: Does not have CSRF checks in some placesCVE-2024-6136 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.6
- What to do
- Update wp-cart-for-digital-products to 8.5.6 or newer.
Aug 6, 2024Light Poll: Does not have CSRF checks in some placesCVE-2024-6720 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5081 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-eMember
- Fixed in
- 10.7.0
- What to do
- Update wp-eMember to 10.7.0 or newer.
Aug 1, 2024Better Find and Replace: Deserialization of Untrusted DataCVE-2024-39636 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.
- Product
- Better Find and Replace
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some placesCVE-2024-2843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Jul 31, 2024HTML Forms: Does not have CSRF checks in some placesCVE-2024-6412 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- HTML Forms
- Fixed in
- 1.3.34
- What to do
- Update HTML Forms to 1.3.34 or newer.
Jul 30, 2024پلاگین پرداخت دلخواه: Does not have CSRF check in placeCVE-2024-6230 · WordPress plugins & themes · reported by WPScanMedium 6.5
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- پلاگین پرداخت دلخواه
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update پلاگین پرداخت دلخواه to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not have CSRF check in some placesCVE-2024-6224 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not have CSRF check in placeCVE-2024-5808 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5285 · WordPress plugins & themes · reported by WPScanMedium 5.5
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.2
- What to do
- Update wp-affiliate-platform to 6.5.2 or newer.
Jul 26, 2024Admin Trim Interface: Full Path DisclosureCVE-2024-6545 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Admin Trim Interface
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Admin Trim Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 22, 2024Search & Replace: Deserialization of Untrusted DataCVE-2024-38759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2.
- Product
- Search & Replace
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Search & Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 22, 2024Community Events: Does not have CSRF check in placeCVE-2024-6271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack
- Product
- Community Events
- Fixed in
- 1.5
- What to do
- Update Community Events to 1.5 or newer.
Jul 22, 2024PZ Frontend Manager: Does not have CSRF checks in some placesCVE-2024-6244 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- PZ Frontend Manager
- Fixed in
- 1.0.6
- What to do
- Update PZ Frontend Manager to 1.0.6 or newer.
Jul 19, 2024ArtPlacer Widget: Does not have CSRF check in some placesCVE-2023-7269 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- ArtPlacer Widget
- Fixed in
- 2.21.2
- What to do
- Update ArtPlacer Widget to 2.21.2 or newer.
Jul 19, 2024ArtPlacer Widget: Does not have authorisation check in placeCVE-2023-7268 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets
- Product
- ArtPlacer Widget
- Fixed in
- 2.21.2
- What to do
- Update ArtPlacer Widget to 2.21.2 or newer.
Jul 15, 2024wp-cart-for-digital-products: Does not have CSRF checks in some placesCVE-2024-6075 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.5
- What to do
- Update wp-cart-for-digital-products to 8.5.5 or newer.
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5287 · WordPress plugins & themes · reported by WPScanHigh 7.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in some placesCVE-2024-5284 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-affiliate-platform: Does not have CSRF check in some placesCVE-2024-5280 · WordPress plugins & themes · reported by WPScanMedium 4.7
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5077 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024wp-eMember: Does not have CSRF checks in some placesCVE-2024-5076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024SULly: Does not have CSRF checks in some placesCVE-2024-5034 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- SULly
- Fixed in
- 4.3.1
- What to do
- Update SULly to 4.3.1 or newer.
Jul 13, 2024SULly: Does not have CSRF check in some placesCVE-2024-5033 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- SULly
- Fixed in
- 4.3.1
- What to do
- Update SULly to 4.3.1 or newer.
Jul 13, 2024CM WordPress Search And Replace: Does not have CSRF checks in some placesCVE-2024-5028 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- CM WordPress Search And Replace
- Fixed in
- 1.3.9
- What to do
- Update CM WordPress Search And Replace to 1.3.9 or newer.
Jul 13, 2024Smart Image Gallery: Does not have CSRF check in placeCVE-2024-3632 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Smart Image Gallery
- Fixed in
- 1.0.19
- What to do
- Update Smart Image Gallery to 1.0.19 or newer.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6024 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6023 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.