WordPress security by component

ElasticPress

Plugin description

ElasticPress is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jun 08, 2024; the highest CVE/CNA score is 4.3.

Plugin slug: elasticpress

Latest vulnerability

CVE-2024-35684: ElasticPress: Cross-site request forgery

ElasticPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

PublishedJun 08, 2024

Safe version guidanceSee mitigation notes

		Safe version
Jun 08, 2024	CVE-2024-35684 ElasticPress: Cross-site request forgery ElasticPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD4.3
Jul 01, 2023	CVE-2021-4405 ElasticPress: Cross-site request forgery ElasticPress is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVDPending