Vulnerability database

11,318 results · page 156 of 227

• Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50508 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

  Product

  Woocommerce Product Design

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024BP Member Type Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager allows Reflected XSS.This issue affects BP Member Type Manager: from n/a through <= 1.01.

  Product

  BP Member Type Manager

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update BP Member Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024CWD 3D Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery allows Reflection Injection.This issue affects CWD 3D Image Gallery: from n/a through <= 1.0.

  Product

  CWD 3D Image Gallery

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update CWD 3D Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WP ERP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP ERP erp allows Reflected XSS.This issue affects WP ERP: from n/a through <= 1.13.2.

  Product

  WP ERP

  Affected

  up to 1.13.2

  What to do

  Affects up to 1.13.2. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Affiliate Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49645 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilias Gomatos Affiliate Platform smdp-affiliate-platform allows Reflected XSS.This issue affects Affiliate Platform: from n/a through <= 1.4.8.

  Product

  Affiliate Platform

  Affected

  up to 1.4.8

  What to do

  Affects up to 1.4.8. Update Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Whitelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment Whitelist fifthsegment-whitelist allows Reflected XSS.This issue affects Whitelist: from n/a through <= 3.5.

  Product

  Whitelist

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update Whitelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Tida URL Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49641 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tidaweb Tida URL Screenshot tida-url-screenshot allows Reflected XSS.This issue affects Tida URL Screenshot: from n/a through <= 1.0.1.

  Product

  Tida URL Screenshot

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Tida URL Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024ACL Floating Cart for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmaderCode Lab ACL Floating Cart for WooCommerce acl-floating-cart-for-woocommerce allows Reflected XSS.This issue affects ACL Floating Cart for WooCommerce: from n/a through <= 0.9.

  Product

  ACL Floating Cart for WooCommerce

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update ACL Floating Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Monitor.chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Stoever Monitor.chat monitor-chat allows Reflected XSS.This issue affects Monitor.chat: from n/a through <= 1.1.1.

  Product

  Monitor.chat

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Monitor.chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Risk Warning Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ventureharbour Risk Warning Bar risk-warning-bar allows Reflected XSS.This issue affects Risk Warning Bar: from n/a through <= 1.0.

  Product

  Risk Warning Bar

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Risk Warning Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Bet WC 2018 Russia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Bet WC 2018 Russia bet-wc-2018-russia allows Reflected XSS.This issue affects Bet WC 2018 Russia: from n/a through <= 2.1.

  Product

  Bet WC 2018 Russia

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Bet WC 2018 Russia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Agile Video Player Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woracal Agile Video Player Lite agile-video-player allows Reflected XSS.This issue affects Agile Video Player Lite: from n/a through <= 1.0.

  Product

  Agile Video Player Lite

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Agile Video Player Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Banner Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manjurul.cis Banner Slider banner-slider allows Reflected XSS.This issue affects Banner Slider: from n/a through <= 2.1.

  Product

  Banner Slider

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Local Business Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49667 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asaduzzaman Abir Local Business Addons For Elementor map-addons-for-elementor-waze-map allows Stored XSS.This issue affects Local Business Addons For Elementor: from n/a through <= 1.1.5.

  Product

  Local Business Addons For Elementor

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Local Business Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Web Bricks Addons for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49665 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web Bricks Web Bricks Addons for Elementor allows Stored XSS.This issue affects Web Bricks Addons for Elementor: from n/a through 1.1.1.

  Product

  Web Bricks Addons for Elementor

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Web Bricks Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024chatplusjp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49664 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chatplusjp chatplusjp chatplusjp allows Reflected XSS.This issue affects chatplusjp: from n/a through <= 1.02.

  Product

  chatplusjp

  Affected

  up to 1.02

  What to do

  Affects up to 1.02. Update chatplusjp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024uCAT – Next Story: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49663 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elenkadark uCAT – Next Story ucat-next-story allows Reflected XSS.This issue affects uCAT – Next Story: from n/a through <= 2.0.0.

  Product

  uCAT – Next Story

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update uCAT – Next Story to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Simple Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49662 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webgensis Simple Load More simple-load-more allows Reflected XSS.This issue affects Simple Load More: from n/a through <= 1.0.

  Product

  Simple Load More

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024leenk.me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49661 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lew Ayotte leenk.me leenkme allows Reflected XSS.This issue affects leenk.me: from n/a through <= 2.16.0.

  Product

  leenk.me

  Affected

  up to 2.16.0

  What to do

  Affects up to 2.16.0. Update leenk.me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Campus Explorer Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49660 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CampusExplorer Campus Explorer Widget campus-explorer-widget allows Reflected XSS.This issue affects Campus Explorer Widget: from n/a through <= 1.4.

  Product

  Campus Explorer Widget

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Campus Explorer Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Coub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coub Coub coub allows DOM-Based XSS.This issue affects Coub: from n/a through <= 1.4.

  Product

  Coub

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Coub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024DocumentPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49656 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment DocumentPress documentpress-display-any-document-on-your-site allows Reflected XSS.This issue affects DocumentPress: from n/a through <= 2.1.

  Product

  DocumentPress

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update DocumentPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Extra Privacy for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49654 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marian Heddesheimer Extra Privacy for Elementor extra-privacy-for-elementor allows Reflected XSS.This issue affects Extra Privacy for Elementor: from n/a through <= 0.1.3.

  Product

  Extra Privacy for Elementor

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Extra Privacy for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WooCommerce Maintenance Mode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49651 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Royal WooCommerce Maintenance Mode woocommerce-maintenance-mode allows Reflected XSS.This issue affects WooCommerce Maintenance Mode: from n/a through <= 2.0.1.

  Product

  WooCommerce Maintenance Mode

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WooCommerce Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024BuddyPress Greeting Message: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49650 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xarbo BuddyPress Greeting Message bp-greeting-message allows Reflected XSS.This issue affects BuddyPress Greeting Message: from n/a through <= 1.0.3.

  Product

  BuddyPress Greeting Message

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update BuddyPress Greeting Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024SVG Captcha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49648 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi SVG Captcha svg-captcha allows Reflected XSS.This issue affects SVG Captcha: from n/a through <= 1.0.11.

  Product

  SVG Captcha

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update SVG Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Simple Custom Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49647 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin simple-custom-admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through <= 1.2.

  Product

  Simple Custom Admin

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Simple Custom Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Code Generate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ioannup Code Generate code-generator allows Reflected XSS.This issue affects Code Generate: from n/a through <= 1.0.

  Product

  Code Generate

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Code Generate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Namaste! LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50410 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.4.

  Product

  Namaste! LMS

  Affected

  up to 2.6.4

  What to do

  Affects up to 2.6.4. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Namaste! LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50409 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

  Product

  Namaste! LMS

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Namaste! LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50407 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

  Product

  Namaste! LMS

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024AffiliateX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49692 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCenter AffiliateX affiliatex allows Stored XSS.This issue affects AffiliateX: from n/a through <= 1.2.9.

  Product

  AffiliateX

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update AffiliateX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49679 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.1.0.

  Product

  WPKoi Templates for Elementor

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024js paper: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7.

  Product

  js paper

  Affected

  up to 2.5.7

  What to do

  Affects up to 2.5.7. Update js paper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024LaTeX2HTML: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49673 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Van Abel LaTeX2HTML latex2html allows Reflected XSS.This issue affects LaTeX2HTML: from n/a through <= 2.5.4.

  Product

  LaTeX2HTML

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update LaTeX2HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Client Power Tools Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49670 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal client-power-tools allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through <= 1.9.0.

  Product

  Client Power Tools Portal

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update Client Power Tools Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50426 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.0.2.

  Product

  Survey Maker

  Affected

  up to 5.0.2

  What to do

  Affects up to 5.0.2. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Time Slot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50418 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Time Slot Booking Time Slot timeslot allows DOM-Based XSS.This issue affects Time Slot: from n/a through <= 1.3.6.

  Product

  Time Slot

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Time Slot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Ads.txt & App-ads.txt Manager for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50415 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.

  Product

  Ads.txt & App-ads.txt Manager for

  Affected

  up to 1.1.7.1

  What to do

  Affects up to 1.1.7.1. Update Ads.txt & App-ads.txt Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Button contact VR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50414 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buttonizer Button contact VR button-contact-vr allows Stored XSS.This issue affects Button contact VR: from n/a through <= 4.7.9.1.

  Product

  Button contact VR

  Affected

  up to 4.7.9.1

  What to do

  Affects up to 4.7.9.1. Update Button contact VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Import and export users and customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50413 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through <= 1.27.5.

  Product

  Import and export users and customers

  Affected

  up to 1.27.5

  What to do

  Affects up to 1.27.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Conditional Fields for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50412 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Stored XSS.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.15.

  Product

  Conditional Fields for Contact Form 7

  Affected

  up to 2.4.15

  What to do

  Affects up to 2.4.15. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WP Abstracts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50411 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.7.1.

  Product

  WP Abstracts

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Todo Custom Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49642 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through <= 3.0.4.

  Product

  Todo Custom Field

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Todo Custom Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Woocommerce Product Design: Unrestricted Upload of File with Dangerous TypeCVE-2024-50482 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

  Product

  Woocommerce Product Design

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Unauthorized user profile modificationCVE-2024-10008 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.

  Product

  Masteriyo LMS – eLearning and Online Course Builder for

  Affected

  up to 1.13.3

  What to do

  Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 28, 2024Plugin Propagator: Unrestricted Upload of File with Dangerous TypeCVE-2024-50495 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in nunomorgadinho Plugin Propagator wp-propagator allows Upload a Web Shell to a Web Server.This issue affects Plugin Propagator: from n/a through <= 0.1.

  Product

  Plugin Propagator

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Plugin Propagator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Qode Essential Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50457 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qode Essential Addons qode-essential-addons.This issue affects Qode Essential Addons: from n/a through <= 1.6.3.

  Product

  Qode Essential Addons

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Qode Essential Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Clean Retina: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50436 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Clean Retina clean-retina.This issue affects Clean Retina: from n/a through <= 3.0.6.

  Product

  Clean Retina

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update Clean Retina to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Meta News: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50435 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through <= 1.1.7.

  Product

  Meta News

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Meta News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.