Vulnerability database

9,260 results · page 123 of 186

• Dec 6, 2024Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54212 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.3.6.

  Product

  Magical Addons For Elementor

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Borderless: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54211 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows Cross-Site Scripting (XSS).This issue affects Borderless: from n/a through <= 1.5.8.

  Product

  Borderless

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Borderless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Advanced Element Bucket Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54210 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codexshaper Advanced Element Bucket Addons for Elementor cs-element-bucket allows Stored XSS.This issue affects Advanced Element Bucket Addons for Elementor: from n/a through <= 1.0.2.

  Product

  Advanced Element Bucket Addons for Elementor

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Advanced Element Bucket Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Awesome Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54209 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Awesome Shortcodes awesome-shortcodes allows Reflected XSS.This issue affects Awesome Shortcodes: from n/a through <= 1.7.2.

  Product

  Awesome Shortcodes

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update Awesome Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Block Controller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54208 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joni Halabi Block Controller block-controller allows Reflected XSS.This issue affects Block Controller: from n/a through <= 1.4.3.

  Product

  Block Controller

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Block Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WordPress Auction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54207 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows Stored XSS.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.

  Product

  WordPress Auction

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Z-Downloads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54206 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in URBAN BASE Z-Downloads z-downloads allows Stored XSS.This issue affects Z-Downloads: from n/a through <= 1.11.7.

  Product

  Z-Downloads

  Affected

  up to 1.11.7

  What to do

  Affects up to 1.11.7. Update Z-Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024All Bootstrap Blocks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-53824 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows PHP Local File Inclusion.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.19.

  Product

  All Bootstrap Blocks

  Affected

  up to 1.3.19

  What to do

  Affects up to 1.3.19. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53823 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.14.

  Product

  The Plus Addons for Elementor Page Builder Lite

  Affected

  up to 5.6.14

  What to do

  Affects up to 5.6.14. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Pie Register Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53821 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Pie Register Premium allows Reflected XSS.This issue affects Pie Register Premium: from n/a before 3.8.3.3.

  Product

  Pie Register Premium

  Fixed in

  3.8.3.3

  What to do

  Update Pie Register Premium to 3.8.3.3 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Captivate Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53820 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Stored XSS.This issue affects Captivate Sync: from n/a through <= 2.0.22.

  Product

  Captivate Sync

  Affected

  up to 2.0.22

  What to do

  Affects up to 2.0.22. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Product Labels For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53817 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Product Labels For Woocommerce aco-product-labels-for-woocommerce allows Blind SQL Injection.This issue affects Product Labels For Woocommerce: from n/a through <= 1.5.8.

  Product

  Product Labels For Woocommerce

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Product Labels For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Pinpoint Booking System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53815 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Blind SQL Injection.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.1.

  Product

  Pinpoint Booking System

  Affected

  up to 2.9.9.5.1

  What to do

  Affects up to 2.9.9.5.1. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WP GeoNames: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53812 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange WP GeoNames wp-geonames allows Reflected XSS.This issue affects WP GeoNames: from n/a through <= 1.8.

  Product

  WP GeoNames

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update WP GeoNames to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Simple User Registration: Missing AuthorizationCVE-2024-53810 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Missing Authorization vulnerability in N-Media Simple User Registration wp-registration allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Simple User Registration: from n/a through <= 5.5.

  Product

  Simple User Registration

  Affected

  up to 5.5

  What to do

  Affects up to 5.5. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024NEX-Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53808 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows SQL Injection.This issue affects NEX-Forms: from n/a through <= 8.7.8.

  Product

  NEX-Forms

  Affected

  up to 8.7.8

  What to do

  Affects up to 8.7.8. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WP Mailster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53807 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brandtoss WP Mailster wp-mailster allows Blind SQL Injection.This issue affects WP Mailster: from n/a through <= 1.8.16.0.

  Product

  WP Mailster

  Affected

  up to 1.8.16.0

  What to do

  Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53802 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through <= 2.0.14.

  Product

  Futurio Extra

  Affected

  up to 2.0.14

  What to do

  Affects up to 2.0.14. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53801 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.2.1.

  Product

  Bold Page Builder

  Affected

  up to 5.2.1

  What to do

  Affects up to 5.2.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53797 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.4.3.

  Product

  Beaver Builder

  Affected

  up to 2.8.4.3

  What to do

  Affects up to 2.8.4.3. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53796 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows DOM-Based XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.2.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Arkhe Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53794 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows Stored XSS.This issue affects Arkhe Blocks: from n/a through <= 2.27.0.

  Product

  Arkhe Blocks

  Affected

  up to 2.27.0

  What to do

  Affects up to 2.27.0. Update Arkhe Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024s2Member: Improper Control of Generation of Code ('Code Injection')CVE-2024-51815 · WordPress plugins & themes · reported by PatchstackCritical 9

  Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through <= 241114.

  Product

  s2Member

  Affected

  up to 241114

  What to do

  Affects up to 241114. Update s2Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WordPress Auction: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51615 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.

  Product

  WordPress Auction

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 5, 2024Simple Redirection: Cross-Site Request ForgeryCVE-2024-11341 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Simple Redirection

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Simple Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 4, 2024FAT Services Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54221 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This issue affects FAT Services Booking: from n/a through <= 5.6.

  Product

  FAT Services Booking

  Affected

  up to 5.6

  What to do

  Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Watu Quiz: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53792 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.1.2.

  Product

  Watu Quiz

  Affected

  up to 3.4.1.2

  What to do

  Affects up to 3.4.1.2. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Simple Header and Footer: Cross-Site Request Forgery (CSRF)CVE-2024-53777 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Alberto Reineri Simple Header and Footer simple-header-and-footer allows Stored XSS.This issue affects Simple Header and Footer: from n/a through <= 1.0.0.

  Product

  Simple Header and Footer

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Simple Header and Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024ArCa Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through <= 1.3.1.

  Product

  ArCa Payment Gateway

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update ArCa Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Simple Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53741 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup simple-popup-plugin allows DOM-Based XSS.This issue affects Simple Popup: from n/a through <= 4.6.

  Product

  Simple Popup

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update Simple Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WooCommerce Ultimate Gift Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53740 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Reflected XSS.This issue affects WooCommerce Ultimate Gift Card: from n/a through < 2.9.1.

  Product

  WooCommerce Ultimate Gift Card

  What to do

  Update WooCommerce Ultimate Gift Card to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Advanced Event Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53721 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stachethemes Advanced Event Manager advanced-event-manager allows Stored XSS.This issue affects Advanced Event Manager: from n/a through <= 1.1.6.

  Product

  Advanced Event Manager

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Advanced Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Simple Travel Map: Cross-Site Request Forgery (CSRF)CVE-2024-53715 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Simple Travel Map simple-travel-map allows Stored XSS.This issue affects Simple Travel Map: from n/a through <= 0.1.

  Product

  Simple Travel Map

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Simple Travel Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Generic Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53709 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows DOM-Based XSS.This issue affects Generic Elements: from n/a through <= 1.2.5.

  Product

  Generic Elements

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Generic Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Tailored Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52503 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tailored Media Tailored Tools tailored-tools allows Stored XSS.This issue affects Tailored Tools: from n/a through <= 1.8.4.

  Product

  Tailored Tools

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024ImbaChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52502 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImbaSynergy ImbaChat imbachat-widget allows DOM-Based XSS.This issue affects ImbaChat: from n/a through <= 3.1.4.

  Product

  ImbaChat

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update ImbaChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Dynamic "To Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52494 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Varone, Tim Berneman Dynamic "To Top" allows Stored XSS.This issue affects Dynamic "To Top": from 3.5.2 through n/a.

  Product

  Dynamic "To Top

  What to do

  Update Dynamic "To Top to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Meteor Slides: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52493 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides meteor-slides allows Stored XSS.This issue affects Meteor Slides: from n/a through <= 1.5.7.

  Product

  Meteor Slides

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update Meteor Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Image horizontal reel scroll slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52492 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Image horizontal reel scroll slideshow image-horizontal-reel-scroll-slideshow allows Stored XSS.This issue affects Image horizontal reel scroll slideshow: from n/a through <= 13.4.

  Product

  Image horizontal reel scroll slideshow

  Affected

  up to 13.4

  What to do

  Affects up to 13.4. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Sticky Social Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52491 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanil Shakya Sticky Social Icons sticky-social-icons allows Stored XSS.This issue affects Sticky Social Icons: from n/a through <= 1.2.1.

  Product

  Sticky Social Icons

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Add Chat App Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52489 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through <= 2.1.5.

  Product

  Add Chat App Button

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Add Chat App Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Ultimate Classified Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52487 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows Stored XSS.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.

  Product

  Ultimate Classified Listings

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Elementor Portfolio Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52486 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SolverWp Elementor Portfolio Builder portfolio-builder-elementor allows DOM-Based XSS.This issue affects Elementor Portfolio Builder: from n/a through <= 1.0.0.

  Product

  Elementor Portfolio Builder

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Elementor Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Wc Recently viewed products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deepintowp Wc Recently viewed products wc-recently-viewed-products allows Reflected XSS.This issue affects Wc Recently viewed products: from n/a through <= 1.0.1.

  Product

  Wc Recently viewed products

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Wc Recently viewed products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LeanPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52483 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Benic LeanPress leanpress allows Reflected XSS.This issue affects LeanPress: from n/a through <= 1.0.0.

  Product

  LeanPress

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update LeanPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Ortto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through <= 1.0.19.

  Product

  Ortto

  Affected

  up to 1.0.19

  What to do

  Affects up to 1.0.19. Update Ortto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Jobify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52478 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Stored XSS.This issue affects Jobify: from n/a through < 4.3.0.

  Product

  Jobify

  Fixed in

  4.2.4

  What to do

  Update Jobify to 4.2.4 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WooCommerce Price Alert: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52469 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhrubok Infotech Services Ltd. WooCommerce Price Alert price-alert-woocommerce allows Reflected XSS.This issue affects WooCommerce Price Alert: from n/a through <= 1.0.4.

  Product

  WooCommerce Price Alert

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update WooCommerce Price Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LeadBoxer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadBoxer LeadBoxer leadboxer allows Reflected XSS.This issue affects LeadBoxer: from n/a through <= 1.3.

  Product

  LeadBoxer

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update LeadBoxer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024AI Responsive Gallery Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Reflected XSS.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.

  Product

  AI Responsive Gallery Album

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.