civi vulnerabilities and fixes

Recent CVEs affecting civi, with upgrade or downgrade steps. 3 tracked.

civi has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-03-14. Highest priority: CVE-2024-13771 (score 49/100).

• CVE-2024-13773 HIGH 7.3 UPGRADE The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive I
• CVE-2024-13772 MEDIUM 5.6 UPGRADE The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authenticat
• CVE-2024-13771 CRITICAL 9.8 UPGRADE The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authenticat

FAQ

How do I fix civi vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is civi being exploited right now?

None of the tracked civi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which civi CVE should I patch first?

CVE-2024-13771 currently ranks highest (49/100): The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authenticat.

RSS feed for civi · ← Back to latest CVEs