Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

12,494 results · page 168 of 250

Oct 18, 2024Social Share With Floating Bar: Reflected Cross-Site ScriptingCVE-2024-8790 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Social Share With Floating Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Social Share With Floating Bar
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Social Share With Floating Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2024GetResponse Forms by Optin Cat: Reflected Cross-Site ScriptingCVE-2024-8740 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
GetResponse Forms by Optin Cat
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update GetResponse Forms by Optin Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2024Edit WooCommerce Templates: Reflected Cross-Site ScriptingCVE-2024-10049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Edit WooCommerce Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Edit WooCommerce Templates
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Edit WooCommerce Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2024Flat UI Button: Stored Cross-Site ScriptingCVE-2024-10014 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flat UI Button
What to do
Update Flat UI Button to the newest version.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 17, 2024Email Template Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49288 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.9.1.
Product
Email Template Customizer for WooCommerce
Affected
up to 1.2.9.1
What to do
Affects up to 1.2.9.1. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024CURCY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49283 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows Reflected XSS.This issue affects CURCY: from n/a through <= 2.2.3.
Product
CURCY
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Responsive Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49282 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows Stored XSS.This issue affects Responsive Lightbox: from n/a through <= 2.4.8.
Product
Responsive Lightbox
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Responsive Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Lightbox slider – Responsive Lightbox Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49280 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery allows Stored XSS.This issue affects Lightbox slider – Responsive Lightbox Gallery: from n/a through <= 1.10.6.
Product
Lightbox slider – Responsive Lightbox Gallery
Affected
up to 1.10.6
What to do
Affects up to 1.10.6. Update Lightbox slider – Responsive Lightbox Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Hyperlink Group Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49279 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through <= 1.17.5.
Product
Hyperlink Group Block
Affected
up to 1.17.5
What to do
Affects up to 1.17.5. Update Hyperlink Group Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.4.3.
Product
Omnipress
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024UltraAddons Elementor Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49277 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.
Product
UltraAddons Elementor Lite
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update UltraAddons Elementor Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Clio Grow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49276 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cliogrow Clio Grow clio-grow-form allows Reflected XSS.This issue affects Clio Grow: from n/a through <= 1.0.2.
Product
Clio Grow
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Clio Grow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Events Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49264 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows Stored XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.0.
Product
Events Addon for Elementor
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024My Favorites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49263 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows Stored XSS.This issue affects My Favorites: from n/a through <= 1.4.1.
Product
My Favorites
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update My Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Country Flags for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49262 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wepic Country Flags for Elementor allows Stored XSS.This issue affects Country Flags for Elementor: from n/a through 1.0.1.
Product
Country Flags for Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Country Flags for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Arkhe Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49261 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks.This issue affects Arkhe Blocks: from n/a through <= 2.23.0.
Product
Arkhe Blocks
Affected
up to 2.23.0
What to do
Affects up to 2.23.0. Update Arkhe Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5.8.
Product
Primary Addon for Elementor
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Da Reactions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49255 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Stored XSS.This issue affects Da Reactions: from n/a through <= 5.1.5.
Product
Da Reactions
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update Da Reactions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49248 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through <= 2.7.37.
Product
Ad Inserter
Affected
up to 2.7.37
What to do
Affects up to 2.7.37. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Awesome Contact Form7 for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49319 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awesome-contact-form7-for-elementor.This issue affects Awesome Contact Form7 for Elementor: from n/a through <= 3.0.
Product
Awesome Contact Form7 for Elementor
Affected
up to 3.0
What to do
Affects up to 3.0. Update Awesome Contact Form7 for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Akismet htaccess writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer akismet-htaccess-writer allows Reflected XSS.This issue affects Akismet htaccess writer: from n/a through <= 1.0.1.
Product
Akismet htaccess writer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Akismet htaccess writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Edwiser Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49311 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Stored XSS.This issue affects Edwiser Bridge: from n/a through <= 3.0.7.
Product
Edwiser Bridge
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.0.
Product
themesflat-addons-for-elementor
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Digitally: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omarfolghe Digitally digitally allows Reflected XSS.This issue affects Digitally: from n/a through <= 1.0.8.
Product
Digitally
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Digitally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Animator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49308 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows Reflected XSS.This issue affects Animator: from n/a through <= 3.0.15.
Product
Animator
Affected
up to 3.0.15
What to do
Affects up to 3.0.15. Update Animator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Admin Management Xtended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Stored XSS.This issue affects Admin Management Xtended : from n/a through <= 2.4.6.
Product
Admin Management Xtended
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024WordPress Portfolio Builder – Portfolio Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49302 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through <= 1.1.7.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024G Meta Keywords: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sinan Yorulmaz G Meta Keywords g-meta-keywords allows Stored XSS.This issue affects G Meta Keywords: from n/a through <= 1.4.
Product
G Meta Keywords
Affected
up to 1.4
What to do
Affects up to 1.4. Update G Meta Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024PeproDev Ultimate Invoice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice pepro-ultimate-invoice allows Stored XSS.This issue affects PeproDev Ultimate Invoice: from n/a through <= 2.0.6.
Product
PeproDev Ultimate Invoice
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Custom Add to Cart Button Label and Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49296 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-cart-button allows Stored XSS.This issue affects Custom Add to Cart Button Label and Link: from n/a through <= 1.6.1.
Product
Custom Add to Cart Button Label and Link
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Custom Add to Cart Button Label and Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49295 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimonials-showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through <= 1.1.6.
Product
Simple Testimonials Showcase
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49292 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-for-elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through <= 2.7.1.
Product
Exclusive Addons Elementor
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Cooked Pro: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This issue affects Cooked Pro: from n/a before 1.8.0.
Product
Cooked Pro
Fixed in
1.8.0
What to do
Update Cooked Pro to 1.8.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Better Author Bio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49229 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arifnezami Better Author Bio better-author-bio allows Reflected XSS.This issue affects Better Author Bio: from n/a through <= 2.7.10.11.
Product
Better Author Bio
Affected
up to 2.7.10.11
What to do
Affects up to 2.7.10.11. Update Better Author Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024EasyJobs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43997 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue affects EasyJobs: from n/a through 2.4.14.
Product
EasyJobs
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update EasyJobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48046 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Stored XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
Product
Contact Form by Supsystic
Affected
up to 1.7.28
What to do
Affects up to 1.7.28. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48036 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks.This issue affects SKT Blocks: from n/a through <= 1.6.
Product
SKT Blocks
Affected
up to 1.6
What to do
Affects up to 1.6. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Featured Posts with Multiple Custom Groups (FPMCG): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48032 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpmcg allows Reflected XSS.This issue affects Featured Posts with Multiple Custom Groups (FPMCG): from n/a through <= 4.0.
Product
Featured Posts with Multiple Custom Groups (FPMCG)
Affected
up to 4.0
What to do
Affects up to 4.0. Update Featured Posts with Multiple Custom Groups (FPMCG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Simple Baseball Scoreboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dogrow Simple Baseball Scoreboard simple-baseball-scoreboard allows Stored XSS.This issue affects Simple Baseball Scoreboard: from n/a through <= 1.3.
Product
Simple Baseball Scoreboard
Affected
up to 1.3
What to do
Affects up to 1.3. Update Simple Baseball Scoreboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Restaurant Reservations Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48023 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rconnect305 Restaurant Reservations Widget restaurantconnect-reswidget allows Reflected XSS.This issue affects Restaurant Reservations Widget: from n/a through <= 1.0.
Product
Restaurant Reservations Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update Restaurant Reservations Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Shortcode For Elementor Templates: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-48022 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SysBasics Shortcode For Elementor Templates allows Stored XSS.This issue affects Shortcode For Elementor Templates: from n/a through 1.0.0.
Product
Shortcode For Elementor Templates
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Shortcode For Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Contact Form 7 – PayPal & Stripe Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48021 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through <= 2.3.
Product
Contact Form 7 – PayPal & Stripe Add-on
Affected
up to 2.3
What to do
Affects up to 2.3. Update Contact Form 7 – PayPal & Stripe Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Encyclopedia / Glossary / Wiki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dennis Encyclopedia / Glossary / Wiki encyclopedia-lexicon-glossary-wiki-dictionary allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through <= 1.7.60.
Product
Encyclopedia / Glossary / Wiki
Affected
up to 1.7.60
What to do
Affects up to 1.7.60. Update Encyclopedia / Glossary / Wiki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-9898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Parallax Image
Affected
up to 1.8
What to do
Affects up to 1.8. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024SendPulse Free Web Push: Stored Cross-Site ScriptingCVE-2024-9184 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SendPulse Free Web Push
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update SendPulse Free Web Push to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024Fonto – Custom Web Fonts Manager: Stored Cross-Site ScriptingCVE-2024-8920 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Fonto – Custom Web Fonts Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Fonto – Custom Web Fonts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024WP Photo Album Plus: Reflected Cross-Site ScriptingCVE-2024-9951 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Photo Album Plus
Affected
up to 8.8.05.003
What to do
Affects up to 8.8.05.003. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 17, 2024افزونه پیامک ووکامرس Persian WooCommerce SMS: Reflected Cross-Site ScriptingCVE-2024-9213 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
افزونه پیامک ووکامرس Persian WooCommerce SMS
Affected
up to 7.0.2
What to do
Affects up to 7.0.2. Update افزونه پیامک ووکامرس Persian WooCommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024The Ultimate WordPress Toolkit – WP Extended: Reflected Cross-Site ScriptingCVE-2024-9347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this fix was reverted in version 3.0.11 and later fixed again in version 3.0.13.
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024Flexmls® IDX: Reflected Cross-Site ScriptingCVE-2024-8719 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Flexmls® IDX
Affected
up to 3.14.22
What to do
Affects up to 3.14.22. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.