Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

4,277 results · page 76 of 86

Apr 26, 2024Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-32829 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.31
What to do
Affects up to 1.10.31. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Flexible Shipping: Missing AuthorizationCVE-2024-32828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.
Product
Flexible Shipping
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update Flexible Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024VK Block Patterns: Missing AuthorizationCVE-2024-32826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.
Product
VK Block Patterns
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update VK Block Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024ENL Newsletter: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-3060 · WordPress plugins & themes · reported by WPScanMedium 4.5
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
Product
ENL Newsletter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2024Google Analytics by Monster Insights: Missing AuthorizationCVE-2023-52220 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MonsterInsights Google Analytics by Monster Insights.This issue affects Google Analytics by Monster Insights: from n/a through 8.21.0.
Product
Google Analytics by Monster Insights
Affected
up to 8.21.0
What to do
Affects up to 8.21.0. Update Google Analytics by Monster Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024TrackShip for WooCommerce: Missing AuthorizationCVE-2024-32678 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TrackShip TrackShip for WooCommerce.This issue affects TrackShip for WooCommerce: from n/a through 1.7.5.
Product
TrackShip for WooCommerce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update TrackShip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024LoginPress Pro: Missing AuthorizationCVE-2024-32677 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Order Limit for WooCommerce: Missing AuthorizationCVE-2024-32675 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Xfinity Soft Order Limit for WooCommerce.This issue affects Order Limit for WooCommerce: from n/a through 2.0.0.
Product
Order Limit for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Order Limit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Ovic Addon Toolkit: Missing AuthorizationCVE-2024-32432 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ovic Team Ovic Addon Toolkit.This issue affects Ovic Addon Toolkit: from n/a through 2.6.1.
Product
Ovic Addon Toolkit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Ovic Addon Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Multi Rating: Missing AuthorizationCVE-2023-32127 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Daniel Powney Multi Rating allows Functionality Misuse.This issue affects Multi Rating: from n/a through 5.0.6.
Product
Multi Rating
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Multi Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WP Post Rating: Missing AuthorizationCVE-2023-25785 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5.
Product
WP Post Rating
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Post Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Quiz Maker: Missing AuthorizationCVE-2023-23985 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
Product
Quiz Maker
Affected
up to 6.3.9.4
What to do
Affects up to 6.3.9.4. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Max Addons Pro for Bricks: Missing AuthorizationCVE-2024-32951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BloomPixel Max Addons Pro for Bricks.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1.
Product
Max Addons Pro for Bricks
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Max Addons Pro for Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024ARMember: Missing AuthorizationCVE-2024-32948 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.
Product
ARMember
Affected
up to 4.0.28
What to do
Affects up to 4.0.28. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2024Shared Files: Missing AuthorizationCVE-2024-32679 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.
Product
Shared Files
Affected
up to 1.7.16
What to do
Affects up to 1.7.16. Update Shared Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Active Products Tables for WooCommerce: Missing AuthorizationCVE-2024-32691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in realmag777 Active Products Tables for WooCommerce.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.2.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.6.2
What to do
Affects up to 1.0.6.2. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024MyRewards: Missing AuthorizationCVE-2024-32688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Long Watch Studio MyRewards.This issue affects MyRewards: from n/a through 5.3.0.
Product
MyRewards
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update MyRewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024WPC Frequently Bought Together for WooCommerce: Missing AuthorizationCVE-2024-32687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.0.3.
Product
WPC Frequently Bought Together for WooCommerce
Affected
up to 7.0.3
What to do
Affects up to 7.0.3. Update WPC Frequently Bought Together for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Wp Ultimate Review: Missing AuthorizationCVE-2024-32684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-32682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-32681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WP Social Comments: Missing AuthorizationCVE-2024-32689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GenialSouls WP Social Comments.This issue affects WP Social Comments: from n/a through 1.7.3.
Product
WP Social Comments
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update WP Social Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Popup Anything: Missing AuthorizationCVE-2024-32601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8.
Product
Popup Anything
Affected
up to 2.8
What to do
Affects up to 2.8. Update Popup Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Ovic Responsive WPBakery: Missing AuthorizationCVE-2024-32142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ovic Team Ovic Responsive WPBakery.This issue affects Ovic Responsive WPBakery: from n/a through 1.3.0.
Product
Ovic Responsive WPBakery
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ovic Responsive WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Support Genix: Missing AuthorizationCVE-2023-49742 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3.
Product
Support Genix
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Uncode Core: Missing AuthorizationCVE-2023-51500 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8.
Product
Uncode Core
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024JVM rich text icons: Missing AuthorizationCVE-2023-51418 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6.
Product
JVM rich text icons
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update JVM rich text icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024If Menu: Missing AuthorizationCVE-2022-41698 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3.
Product
If Menu
Affected
up to 0.16.3
What to do
Affects up to 0.16.3. Update If Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Honeypot for WP Comment: Missing AuthorizationCVE-2024-1350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Prasidhda Malla Honeypot for WP Comment.This issue affects Honeypot for WP Comment: from n/a through 2.2.3.
Product
Honeypot for WP Comment
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Honeypot for WP Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Simple File List: Missing AuthorizationCVE-2023-44227 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.
Product
Simple File List
Affected
up to 6.1.9
What to do
Affects up to 6.1.9. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Speed Optimizer: Missing AuthorizationCVE-2024-32532 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.
Product
Speed Optimizer
Affected
up to 7.4.6
What to do
Affects up to 7.4.6. Update Speed Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Theme My Login: Missing AuthorizationCVE-2024-32525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
Product
Theme My Login
Affected
up to 7.1.6
What to do
Affects up to 7.1.6. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Custom Order Statuses for WooCommerce: Missing AuthorizationCVE-2024-32524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
Product
Custom Order Statuses for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Custom Order Statuses for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Open Close WooCommerce Store: Missing AuthorizationCVE-2024-32522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jaed Mosharraf & Pluginbazar Team Open Close WooCommerce Store.This issue affects Open Close WooCommerce Store: from n/a through 4.9.1.
Product
Open Close WooCommerce Store
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WPC Grouped Product for WooCommerce: Missing AuthorizationCVE-2024-32520 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Grouped Product for WooCommerce.This issue affects WPC Grouped Product for WooCommerce: from n/a through 4.4.2.
Product
WPC Grouped Product for WooCommerce
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WPC Grouped Product for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024GG Woo Feed for WooCommerce: Missing AuthorizationCVE-2024-32519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GutenGeek GG Woo Feed for WooCommerce.This issue affects GG Woo Feed for WooCommerce: from n/a through 1.2.6.
Product
GG Woo Feed for WooCommerce
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update GG Woo Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024PeproDev Ultimate Invoice: Missing AuthorizationCVE-2024-32518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.
Product
PeproDev Ultimate Invoice
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Custom Thank You Page Customize For WooCommerce by Binary Carpenter: Missing AuthorizationCVE-2024-32517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WooCommerce & WordPress Tutorials Custom Thank You Page Customize For WooCommerce by Binary Carpenter.This issue affects Custom Thank You Page Customize For WooCommerce by Binary Carpenter: from n/a through 1.4.12.
Product
Custom Thank You Page Customize For WooCommerce by Binary Carpenter
Affected
up to 1.4.12
What to do
Affects up to 1.4.12. Update Custom Thank You Page Customize For WooCommerce by Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Multi Currency For WooCommerce: Missing AuthorizationCVE-2024-32516 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through 1.5.5.
Product
Multi Currency For WooCommerce
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Multi Currency For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Mega Addons For Elementor: Missing AuthorizationCVE-2024-32515 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Qamar Sheeraz, Nasir Ahmad Mega Addons For Elementor.This issue affects Mega Addons For Elementor: from n/a through 1.8.
Product
Mega Addons For Elementor
Affected
up to 1.8
What to do
Affects up to 1.8. Update Mega Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP Cost Estimation & Payment Forms Builder: Missing AuthorizationCVE-2024-32509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.76.
Product
WP Cost Estimation & Payment Forms Builder
Affected
up to 10.1.76
What to do
Affects up to 10.1.76. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Fatal Error Notify: Missing AuthorizationCVE-2024-32455 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Very Good Plugins Fatal Error Notify.This issue affects Fatal Error Notify: from n/a through 1.5.2.
Product
Fatal Error Notify
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Fatal Error Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024MoveTo: Missing AuthorizationCVE-2024-25911 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2.
Product
MoveTo
Affected
up to 6.2
What to do
Affects up to 6.2. Update MoveTo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024LiteSpeed Cache: Missing AuthorizationCVE-2023-45000 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.
Product
LiteSpeed Cache
Affected
up to 5.7
What to do
Affects up to 5.7. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Popup by Supsystic: Missing AuthorizationCVE-2024-31421 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through <= 1.10.27.
Product
Popup by Supsystic
Affected
up to 1.10.27
What to do
Affects up to 1.10.27. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Restrict Content: Missing AuthorizationCVE-2024-31432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP Restrict Content.This issue affects Restrict Content: from n/a through 3.2.8.
Product
Restrict Content
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024WooCommerce Customers Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0399 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
Product
WooCommerce Customers Manager
Fixed in
29.7
What to do
Update WooCommerce Customers Manager to 29.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-1957 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2024WP Job Manager: Missing AuthorizationCVE-2023-52211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0.
Product
WP Job Manager
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024Uncode Core: Missing AuthorizationCVE-2023-51515 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.
Product
Uncode Core
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.