Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

448new WordPress flaws this week

393,150entries in the database

11,318 results · page 151 of 227

Nov 19, 2024Tigris Flexplatform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51819 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tigrisflexplatform Tigris Flexplatform tigris-flexplatform allows Stored XSS.This issue affects Tigris Flexplatform: from n/a through <= 1.0.2.
Product
Tigris Flexplatform
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Tigris Flexplatform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Banner System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saul Morales Pacheco Banner System banner-system allows Stored XSS.This issue affects Banner System: from n/a through <= 1.0.0.
Product
Banner System
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Banner System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024活动链接推广插件: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 野人活动链接推广插件 yr-activity-link allows DOM-Based XSS.This issue affects 活动链接推广插件: from n/a through <= 1.2.0.
Product
活动链接推广插件
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update 活动链接推广插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Anant Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows DOM-Based XSS.This issue affects Anant Addons for Elementor: from n/a through <= 1.0.5.
Product
Anant Addons for Elementor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Anant Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Pro Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51812 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasim Pro Addons For Elementor pro-addons-for-elementor allows Stored XSS.This issue affects Pro Addons For Elementor: from n/a through <= 1.5.0.
Product
Pro Addons For Elementor
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Pro Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Popup Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51811 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hussam Hussien Popup Image popup-image allows Stored XSS.This issue affects Popup Image: from n/a through <= 1.0.1.
Product
Popup Image
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Popup Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Lewe Bootstrap Visuals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51810 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Lewe Lewe Bootstrap Visuals shortcode-bootstrap-visuals allows Stored XSS.This issue affects Lewe Bootstrap Visuals: from n/a through <= 3.0.1.
Product
Lewe Bootstrap Visuals
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Lewe Bootstrap Visuals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Keymaster Chord Notation Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51809 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in intelligentDesign Keymaster Chord Notation Free keymaster-chord-notation-free allows Stored XSS.This issue affects Keymaster Chord Notation Free: from n/a through <= 1.0.2.
Product
Keymaster Chord Notation Free
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Keymaster Chord Notation Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024codeSnips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pat O’Brien codeSnips codesnips allows Stored XSS.This issue affects codeSnips: from n/a through <= 1.2.
Product
codeSnips
Affected
up to 1.2
What to do
Affects up to 1.2. Update codeSnips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024AgendaPress – Easily Publish Meeting Agendas and Programs on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Black and White AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress agendapress allows Stored XSS.This issue affects AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress: from n/a through <= 1.0.8.
Product
AgendaPress – Easily Publish Meeting Agendas and Programs on
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update AgendaPress – Easily Publish Meeting Agendas and Programs on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Fitness Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51806 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shingo Awesome Fitness Testimonials awesome-fitness-testimonials allows Stored XSS.This issue affects Awesome Fitness Testimonials: from n/a through <= 1.0.1.
Product
Awesome Fitness Testimonials
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Awesome Fitness Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024yPHPlista: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonisink yPHPlista yphplista allows Stored XSS.This issue affects yPHPlista: from n/a through <= 1.1.1.
Product
yPHPlista
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update yPHPlista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Moka Get Posts Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51804 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobmatnyc Moka Get Posts Shortcode moka-get-posts allows DOM-Based XSS.This issue affects Moka Get Posts Shortcode: from n/a through <= 1.0.
Product
Moka Get Posts Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Moka Get Posts Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Inline Click To Tweet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnetic Creative Inline Click To Tweet inline-click-to-tweet allows DOM-Based XSS.This issue affects Inline Click To Tweet: from n/a through <= 1.0.0.
Product
Inline Click To Tweet
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Inline Click To Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Bread & Butter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bread & Butter Bread & Butter bread-butter allows DOM-Based XSS.This issue affects Bread & Butter: from n/a through <= 7.4.857.
Product
Bread & Butter
Affected
up to 7.4.857
What to do
Affects up to 7.4.857. Update Bread & Butter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Brand my Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51801 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jakeatthrive Brand my Footer brand-my-footer allows DOM-Based XSS.This issue affects Brand my Footer: from n/a through <= 1.1.
Product
Brand my Footer
Affected
up to 1.1
What to do
Affects up to 1.1. Update Brand my Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Bg Patriarchia BU: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vadim Bogaiskov Bg Patriarchia BU bg-patriarchia-bu allows DOM-Based XSS.This issue affects Bg Patriarchia BU: from n/a through <= 2.2.3.
Product
Bg Patriarchia BU
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Bg Patriarchia BU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Surbma | Font Awesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Font Awesome surbma-font-awesome allows DOM-Based XSS.This issue affects Surbma | Font Awesome: from n/a through <= 3.0.
Product
Surbma | Font Awesome
Affected
up to 3.0
What to do
Affects up to 3.0. Update Surbma | Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Ultimate Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51797 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Ultimate Accordion ultimate-accordion allows DOM-Based XSS.This issue affects Ultimate Accordion: from n/a through <= 1.0.
Product
Ultimate Accordion
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ultimate Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Trendy Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjahan Jewel Trendy Restaurant Menu trendy-restaurant-menu allows DOM-Based XSS.This issue affects Trendy Restaurant Menu: from n/a through <= 1.0.0.
Product
Trendy Restaurant Menu
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Trendy Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Pdf Embedder Fay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fayjur Pdf Embedder Fay pdf-embedder-fay allows DOM-Based XSS.This issue affects Pdf Embedder Fay: from n/a through <= 1.10.1.
Product
Pdf Embedder Fay
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update Pdf Embedder Fay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Storely: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51794 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sellerthemes Storely storely allows Stored XSS.This issue affects Storely: from n/a through <= 14.7.
Product
Storely
Affected
up to 14.7
What to do
Affects up to 14.7. Update Storely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Clyp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51617 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clyp Clyp clyp allows Stored XSS.This issue affects Clyp: from n/a through <= 1.3.
Product
Clyp
Affected
up to 1.3
What to do
Affects up to 1.3. Update Clyp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024WM Zoom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50556 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WorldMarkerter WM Zoom wm-zoom allows DOM-Based XSS.This issue affects WM Zoom: from n/a through <= 1.0.
Product
WM Zoom
Affected
up to 1.0
What to do
Affects up to 1.0. Update WM Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Sided: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50554 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sided Sided sided allows DOM-Based XSS.This issue affects Sided: from n/a through <= 1.4.5.
Product
Sided
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Sided to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Classy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50553 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Classy Addons Classy Addons for Elementor classy-addons-for-elementor allows DOM-Based XSS.This issue affects Classy Addons for Elementor: from n/a through <= 1.2.7.
Product
Classy Addons for Elementor
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Classy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Hover Video Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jasonpancake Hover Video Preview hover-video-preview allows Stored XSS.This issue affects Hover Video Preview: from n/a through <= 1.0.2.
Product
Hover Video Preview
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Hover Video Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024EndomondoWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Odyno EndomondoWP endomondowp allows Stored XSS.This issue affects EndomondoWP: from n/a through <= 0.1.1.
Product
EndomondoWP
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update EndomondoWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Bonway Static Block Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50549 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steven Nolles Bonway Static Block Editor bonway-static-block-editor allows DOM-Based XSS.This issue affects Bonway Static Block Editor: from n/a through <= 1.1.0.
Product
Bonway Static Block Editor
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Bonway Static Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Progress Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abdullah Nahian Awesome Progress Bar awesome-progess-bar allows DOM-Based XSS.This issue affects Awesome Progress Bar: from n/a through <= 1.0.13.
Product
Awesome Progress Bar
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Awesome Progress Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Themedy Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Hodder Themedy Toolbox themedy-toolbox allows DOM-Based XSS.This issue affects Themedy Toolbox: from n/a through <= 1.0.16.
Product
Themedy Toolbox
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Themedy Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024MyOrderDesk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riley Magnuson MyOrderDesk myorderdesk allows DOM-Based XSS.This issue affects MyOrderDesk: from n/a through <= 3.2.6.
Product
MyOrderDesk
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update MyOrderDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024DataMentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50545 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AuburnForest DataMentor datamentor allows DOM-Based XSS.This issue affects DataMentor: from n/a through <= 1.7.
Product
DataMentor
Affected
up to 1.7
What to do
Affects up to 1.7. Update DataMentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024amazing neo icon font for elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mudssar amazing neo icon font for elementor amazing-neo-icon-font-for-elementor allows DOM-Based XSS.This issue affects amazing neo icon font for elementor: from n/a through <= 2.0.1.
Product
amazing neo icon font for elementor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update amazing neo icon font for elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024RLM Elementor Widgets Pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zachsilberstein RLM Elementor Widgets Pack rlm-elementor-widgets-pack allows DOM-Based XSS.This issue affects RLM Elementor Widgets Pack: from n/a through <= 1.3.1.
Product
RLM Elementor Widgets Pack
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update RLM Elementor Widgets Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Stored XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
Product
Advanced Control Manager for WordPress by ItalyStrap
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024(dp) AddThis: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in demixpress (dp) AddThis dp-addthis allows Stored XSS.This issue affects (dp) AddThis: from n/a through <= 1.0.2.
Product
(dp) AddThis
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update (dp) AddThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Show Visitor IP Address: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50538 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in irfantea Show Visitor IP Address show-visitor-ip-address allows Stored XSS.This issue affects Show Visitor IP Address: from n/a through <= 0.2.
Product
Show Visitor IP Address
Affected
up to 0.2
What to do
Affects up to 0.2. Update Show Visitor IP Address to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Smart Mockups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Marra Smart Mockups smart-mockups allows Stored XSS.This issue affects Smart Mockups: from n/a through <= 1.2.0.
Product
Smart Mockups
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Smart Mockups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024GDReseller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamer Ziady GDReseller gdreseller allows DOM-Based XSS.This issue affects GDReseller: from n/a through <= 1.6.
Product
GDReseller
Affected
up to 1.6
What to do
Affects up to 1.6. Update GDReseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Step by Step: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50535 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle M Brown Step by Step step-by-step allows Stored XSS.This issue affects Step by Step: from n/a through <= 0.4.5.
Product
Step by Step
Affected
up to 0.4.5
What to do
Affects up to 0.4.5. Update Step by Step to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Events Manager Pro – extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50532 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through <= 0.1.
Product
Events Manager Pro – extended
Affected
up to 0.1
What to do
Affects up to 0.1. Update Events Manager Pro – extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024WeChat Subscribers Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through <= 1.6.6.
Product
WeChat Subscribers Lite
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update WeChat Subscribers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Alley Elementor Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50521 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Alley Elementor Widget alley-elementor-widget allows DOM-Based XSS.This issue affects Alley Elementor Widget: from n/a through <= 1.0.7.
Product
Alley Elementor Widget
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Alley Elementor Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Ancient World Linked Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50520 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter J. Herrel Ancient World Linked Data ancient-world-linked-data-for-wordpress allows DOM-Based XSS.This issue affects Ancient World Linked Data: from n/a through <= 0.2.1.
Product
Ancient World Linked Data
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Ancient World Linked Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Jigoshop – Store Exporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50519 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through <= 1.5.8.
Product
Jigoshop – Store Exporter
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Jigoshop – Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Pricer Ninja: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50518 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Pricer Ninja pricer-ninja-pricing-tables allows Stored XSS.This issue affects Pricer Ninja: from n/a through <= 2.1.0.
Product
Pricer Ninja
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Pricer Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024ID-SK Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50517 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDSK team ID-SK Toolkit idsk-toolkit allows Stored XSS.This issue affects ID-SK Toolkit: from n/a through <= 1.7.2.
Product
ID-SK Toolkit
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update ID-SK Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Countdown & Clock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50516 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Countdown & Clock countdown-builder allows Stored XSS.This issue affects Countdown & Clock: from n/a through <= 3.0.8.
Product
Countdown & Clock
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50515 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
Product
Ninja Forms
Affected
up to 3.8.16
What to do
Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.