Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

545new WordPress flaws this week

391,964entries in the database

6,273 results · page 97 of 126

Aug 19, 2024Bit Form Pro: Incorrect AuthorizationCVE-2024-43250 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4.
Product
Bit Form Pro
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024WHMpress: Missing AuthorizationCVE-2024-43247 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.
Product
WHMpress
Affected
up to 6.2-revision-5
What to do
Affects up to 6.2-revision-5. Update WHMpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Propovoice CRM: Authorization Bypass Through User-Controlled KeyCVE-2024-43350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Propovoice Propovoice CRM.This issue affects Propovoice CRM: from n/a through 1.7.6.4.
Product
Propovoice CRM
Affected
up to 1.7.6.4
What to do
Affects up to 1.7.6.4. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43322 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
Product
Zephyr Project Manager
Affected
up to 3.3.100
What to do
Affects up to 3.3.100. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Stripe Payments For WooCommerce by Checkout: Authorization Bypass Through User-Controlled KeyCVE-2024-43315 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
Product
Stripe Payments For WooCommerce by Checkout
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Stripe Payments For WooCommerce by Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2024-43288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
Product
wpForo Forum
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2024-43266 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.
Product
WP Job Portal
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Masteriyo - LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-43239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
Product
Masteriyo - LMS
Affected
up to 1.11.4
What to do
Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Sensei LMS: Missing AuthorizationCVE-2024-35686 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.
Product
Sensei LMS
Affected
up to 4.23.1
What to do
Affects up to 4.23.1. Update Sensei LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 17, 2024LadiApp plugn: Unauthorized modification of dataCVE-2023-4730 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.
Product
LadiApp plugn
Affected
up to 4.3
What to do
Affects up to 4.3. Update LadiApp plugn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4027 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4025 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 17, 2024Radio Player: Unauthorized modification of dataCVE-2023-4024 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 16, 2024The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability checCVE-2024-6500 · WordPress plugins & themes · reported by WordfenceCritical 10
The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read.
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024Docket (WooCommerce Collections / Wishlist / Watchlist): Incorrect AuthorizationCVE-2024-43131 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Incorrect Authorization vulnerability in WPWeb Docket (WooCommerce Collections / Wishlist / Watchlist) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket (WooCommerce Collections / Wishlist / Watchlist): from n/a before 1.7.0.
Product
Docket (WooCommerce Collections / Wishlist / Watchlist)
Fixed in
1.7.0
What to do
Update Docket (WooCommerce Collections / Wishlist / Watchlist) to 1.7.0 or newer.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024LearnPress: Authorization Bypass Through User-Controlled KeyCVE-2024-39642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LearnPress: from n/a through 4.2.6.8.2.
Product
LearnPress
Affected
up to 4.2.6.8.2
What to do
Affects up to 4.2.6.8.2. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Send Users Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Maucher Send Users Email allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Send Users Email: from n/a through 1.5.1.
Product
Send Users Email
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Send Users Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Coming Soon: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38756 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming Soon: from n/a through 1.6.3.
Product
Coming Soon
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Olive One Click Demo Import: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38749 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Olive Themes Olive One Click Demo Import allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Olive One Click Demo Import: from n/a through 1.1.2.
Product
Olive One Click Demo Import
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Olive One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024HitPay Payment Gateway for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38747 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HitPay Payment Solutions Pte Ltd HitPay Payment Gateway for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects HitPay Payment Gateway for WooCommerce: from n/a through 4.1.3.
Product
HitPay Payment Gateway for WooCommerce
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update HitPay Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024MBE eShip: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38742 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MBE Worldwide S.P.A. MBE eShip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MBE eShip: from n/a through 2.1.2.
Product
MBE eShip
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update MBE eShip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Wallet System for WooCommerce: Missing AuthorizationCVE-2024-38699 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Swings Wallet System for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wallet System for WooCommerce: from n/a through 2.5.13.
Product
Wallet System for WooCommerce
Affected
up to 2.5.13
What to do
Affects up to 2.5.13. Update Wallet System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Woocommerce OpenPos: Missing AuthorizationCVE-2024-37935 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.
Product
Woocommerce OpenPos
Affected
up to 6.4.4
What to do
Affects up to 6.4.4. Update Woocommerce OpenPos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024WP2Speed Faster: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37924 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP2Speed Faster: from n/a through 1.0.1.
Product
WP2Speed Faster
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP2Speed Faster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized modification of dataCVE-2024-7621 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_wpfeedback_misc_options() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings which can also be leveraged to gain access to the plugin's settings.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2024Premium Addons for Elementor: Unauthorized modification and loss of dataCVE-2024-6824 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'check_temp_validity' and 'update_template_title' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles.
Product
Premium Addons for Elementor
Affected
up to 4.10.38
What to do
Affects up to 4.10.38. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2024Orchid Store: Unauthorized modification of dataCVE-2024-6987 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Addonify Floating Cart For WooCommerce plugin if it is installed.
Product
Orchid Store
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Aug 8, 2024Falang multilanguage for: Unauthorized modification of dataCVE-2024-6869 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete translations and expose the administrator email address.
Product
Falang multilanguage for
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update Falang multilanguage for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2024Sync Post With Other Site: Unauthorized modification of dataCVE-2024-6709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_post' function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new draft posts and update existing posts.
Product
Sync Post With Other Site
Affected
up to 1.6
What to do
Affects up to 1.6. Update Sync Post With Other Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-7031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.
Product
File Manager Pro – Filester
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024Zephyr Project Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38761 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.
Product
Zephyr Project Manager
Affected
up to 3.3.99
What to do
Affects up to 3.3.99. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Breakdance: Unauthorized access of dataCVE-2024-5331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to export form submissions.
Product
Breakdance
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Breakdance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record breakdance.com wordfence.com
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Product
WooCommerce Customers Manager
Fixed in
30.2
What to do
Update WooCommerce Customers Manager to 30.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2024Tainacan: Unauthorized access of dataCVE-2024-7135 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Tainacan
Affected
up to 0.21.7
What to do
Affects up to 0.21.7. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2024WP Mobile Menu: Unauthorized modification of dataCVE-2024-2508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.
Product
WP Mobile Menu
Affected
up to 2.8.4.4
What to do
Affects up to 2.8.4.4. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 31, 2024it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.CVE-2024-6695 · WordPress plugins & themes · reported by WPScanCritical 9.8
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
Fixed in
3.11.9
What to do
Update the plugin to 3.11.9 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2024User Profile Builder: Does not have proper authorisationCVE-2024-6366 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
Product
User Profile Builder
Fixed in
3.11.8
What to do
Update User Profile Builder to 3.11.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 27, 2024WooCommerce Product Table Lite: Unauthorized post title modificationCVE-2024-6458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.
Product
WooCommerce Product Table Lite
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2024Ultimate WordPress Auction: Unauthorized email creation and sendingCVE-2024-6591 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
Product
Ultimate WordPress Auction
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update Ultimate WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 26, 2024IgnitionDeck Crowdfunding Platform: Missing AuthorizationCVE-2024-4410 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This makes it possible for authenticated attackers, with subscriber access or higher, to execute various AJAX actions. This includes actions to change the permalink structure, plugin settings and others.
Product
IgnitionDeck Crowdfunding Platform
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update IgnitionDeck Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2024Tutor LMS – Migration Tool: Unauthorized modification of dataCVE-2024-1804 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_from_xml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to import courses.
Product
Tutor LMS – Migration Tool
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Tutor LMS – Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2024Tutor LMS – Migration Tool: Unauthorized access of dataCVE-2024-1798 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to export courses, including private and password protected courses.
Product
Tutor LMS – Migration Tool
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Tutor LMS – Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2024During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests oCVE-2024-6490 · WordPress plugins & themes · reported by WPScanMedium 6.5
During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.
Product
Master Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2024WP EasyPay – Square for: Unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() functionCVE-2024-5861 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
Product
WP EasyPay – Square for
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update WP EasyPay – Square for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2024Social Auto Poster: Unauthorized modification and loss of dataCVE-2024-6755 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 23, 2024Social Auto Poster: Unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ functionCVE-2024-6754 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 23, 2024Social Auto Poster: Unauthorized access, modification, and loss of dataCVE-2024-6750 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 22, 2024Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-38701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
Product
Academy LMS
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024WP Post Author: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37101 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AF themes WP Post Author allows Stored XSS.This issue affects WP Post Author: from n/a through 3.6.7.
Product
WP Post Author
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Meks Smart Author Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Smart Author Widget allows Stored XSS.This issue affects Meks Smart Author Widget: from n/a through 1.1.4.
Product
Meks Smart Author Widget
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Meks Smart Author Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.