Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

456new WordPress flaws this week

393,009entries in the database

11,315 results · page 144 of 227

Dec 13, 2024Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54303 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through <= 2.3.8.
Product
Simple Payment
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024VPSUForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54302 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.0.0.
Product
VPSUForm
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024FormFacade: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54301 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manidoraisamy FormFacade formfacade allows Reflected XSS.This issue affects FormFacade: from n/a through <= 1.3.6.
Product
FormFacade
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update FormFacade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Revi.io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54299 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revidev Revi.io revi-io-customer-and-product-reviews allows Reflected XSS.This issue affects Revi.io: from n/a through <= 5.7.3.
Product
Revi.io
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update Revi.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Appsplate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54292 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.
Product
Appsplate
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Appsplate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Role Includer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Fletcher Role Includer role-includer allows Reflected XSS.This issue affects Role Includer: from n/a through <= 1.6.
Product
Role Includer
Affected
up to 1.6
What to do
Affects up to 1.6. Update Role Includer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024LDD Directory Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54288 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LDD Web Design LDD Directory Lite ldd-directory-lite allows Reflected XSS.This issue affects LDD Directory Lite: from n/a through <= 3.3.
Product
LDD Directory Lite
Affected
up to 3.3
What to do
Affects up to 3.3. Update LDD Directory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Advanced Blog Post Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.
Product
Advanced Blog Post Block
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Advanced Blog Post Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Smaily for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54286 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This issue affects Smaily for WP: from n/a through <= 3.1.5.
Product
Smaily for WP
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Smaily for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Nias course: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54277 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based XSS.This issue affects Nias course: from n/a through <= 1.2.10.
Product
Nias course
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Nias course to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Poll Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54276 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devfelixmoira Poll Builder poll-builder allows Stored XSS.This issue affects Poll Builder: from n/a through <= 1.3.5.
Product
Poll Builder
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Poll Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024CSV to html: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54275 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wibergsweb CSV to html csv-to-html allows Reflected XSS.This issue affects CSV to html: from n/a through <= 3.08.
Product
CSV to html
Affected
up to 3.08
What to do
Affects up to 3.08. Update CSV to html to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54274 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
Product
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Radius Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54272 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS.This issue affects Radius Blocks: from n/a through <= 2.1.2.
Product
Radius Blocks
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Radius Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024ImageRecycle pdf & image compression: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54266 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compression: from n/a through <= 3.1.16.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.16
What to do
Affects up to 3.1.16. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54265 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.6.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Shortcodes Blocks Creator Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/a through <= 2.2.0.
Product
Shortcodes Blocks Creator Ultimate
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Shortcodes Blocks Creator Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024TAX SERVICE Electronic HDM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54261 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through <= 1.2.2.
Product
TAX SERVICE Electronic HDM
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update TAX SERVICE Electronic HDM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
Product
DELUCKS SEO
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54258 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
Product
Ni CRM Lead
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Easy Blocks pro: Missing AuthorizationCVE-2024-54256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.
Product
Easy Blocks pro
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Easy Blocks pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Prodigy Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54250 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.
Product
Prodigy Commerce
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54246 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.
Product
FAQs
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.
Product
Clients
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Easy Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.
Product
Easy Replace
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Echoza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.
Product
Echoza
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Echoza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: Missing AuthorizationCVE-2024-54241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.
Product
Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification
What to do
Update Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Blaze Online eParcel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.
Product
Blaze Online eParcel for WooCommerce
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Blaze Online eParcel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.
Product
Board Document Manager from CHUHPL
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
Product
Ni CRM Lead
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni WooCommerce Bulk Product Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.
Product
Ni WooCommerce Bulk Product Editor
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Ni WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Shiptimize for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.86.
Product
Shiptimize for WooCommerce
Affected
up to 3.1.86
What to do
Affects up to 3.1.86. Update Shiptimize for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54234 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
Product
Limit Login Attempts
Affected
up to 5.5
What to do
Affects up to 5.5. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
Product
Advanced Control Manager for WordPress by ItalyStrap
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni WooCommerce Order Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54231 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-order-export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through <= 3.1.6.
Product
Ni WooCommerce Order Export
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Ni WooCommerce Order Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Slider Pro: Missing AuthorizationCVE-2023-41865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.
Product
Slider Pro
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WiserNotify Social Proof: Missing AuthorizationCVE-2023-41690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wiser Notify WiserNotify Social Proof allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserNotify Social Proof: from n/a through 2.5.
Product
WiserNotify Social Proof
Affected
up to 2.5
What to do
Affects up to 2.5. Update WiserNotify Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Post to Google My Business (Google Business Profile): Missing AuthorizationCVE-2023-41689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.
Product
Post to Google My Business (Google Business Profile)
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Post to Google My Business (Google Business Profile) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ovic Product Bundle: Missing AuthorizationCVE-2023-41649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ovic Team Ovic Product Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovic Product Bundle: from n/a through 1.1.2.
Product
Ovic Product Bundle
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Ovic Product Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Project Manager: Missing AuthorizationCVE-2023-40003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in weDevs WP Project Manager wedevs-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Project Manager: from n/a through <= 2.6.7.
Product
WP Project Manager
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Portfolio and Projects: Missing AuthorizationCVE-2023-39995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7.
Product
Portfolio and Projects
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WooCommerce Product Stock Alert: Missing AuthorizationCVE-2023-37971 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.
Product
WooCommerce Product Stock Alert
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024SW Product Bundles: Missing AuthorizationCVE-2023-36519 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.
Product
SW Product Bundles
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update SW Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Spam protection, AntiSpam, FireWall by CleanTalk: Missing AuthorizationCVE-2023-33996 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTalk: from n/a through 6.10.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Affected
up to 6.10
What to do
Affects up to 6.10. Update Spam protection, AntiSpam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Booking Ultra Pro: Missing AuthorizationCVE-2023-32601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Booking Ultra Pro Booking Ultra Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Ultra Pro: from n/a through 1.1.12.
Product
Booking Ultra Pro
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Property Hive Stamp Duty Calculator: Stored Cross-Site ScriptingCVE-2024-12465 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Property Hive Stamp Duty Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stamp_duty_calculator_scotland' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Property Hive Stamp Duty Calculator
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update Property Hive Stamp Duty Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Currency Converter Widget ⚡ PRO: Stored Cross-Site ScriptingCVE-2024-11760 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Currency Converter Widget ⚡ PRO
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Currency Converter Widget ⚡ PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPreCVE-2024-11727 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content settings for notifications in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Product Carousel Slider & Grid Ultimate for WooCommerce: Local File InclusionCVE-2024-12040 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Product Carousel Slider & Grid Ultimate for WooCommerce
Affected
up to 1.9.10
What to do
Affects up to 1.9.10. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Membership Plan settingsCVE-2024-10518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.15.15
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.