Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,183 results · page 17 of 64
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8851 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
- Product
- Polls CP
- Fixed in
- 1.0.77
- What to do
- Update Polls CP to 1.0.77 or newer.
May 15, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2024-8759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Nested Pages
- Fixed in
- 3.2.9
- What to do
- Update Nested Pages to 3.2.9 or newer.
May 15, 2025Z-Downloads: Does not sanitise and escape some parametersCVE-2024-8703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs.
- Product
- Z-Downloads
- Fixed in
- 1.11.6
- What to do
- Update Z-Downloads to 1.11.6 or newer.
May 15, 2025Backup Database: Does not sanitise and escape some of its settingsCVE-2024-8702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Backup Database
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update Backup Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025events-calendar: Does not sanitise and escape some of its settingsCVE-2024-8701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- events-calendar
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update events-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.29
- What to do
- Update Photo Gallery by 10Web to 1.8.29 or newer.
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MapPress Maps for
- Fixed in
- 2.93
- What to do
- Update MapPress Maps for to 2.93 or newer.
May 15, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-8619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ajax Search Lite
- Fixed in
- 4.12.3
- What to do
- Update Ajax Search Lite to 4.12.3 or newer.
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.9.0
- What to do
- Update Page Builder: Pagelayer to 1.9.0 or newer.
May 15, 2025Quiz Maker: Does not sanitize and escape some of its settingsCVE-2024-8617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quiz Maker
- Fixed in
- 6.5.9.9
- What to do
- Update Quiz Maker to 6.5.9.9 or newer.
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.3.1
- What to do
- Update Everest Forms to 3.0.3.1 or newer.
May 15, 2025Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-8493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Events Calendar
- Fixed in
- 6.6.4
- What to do
- Update Events Calendar to 6.6.4 or newer.
May 15, 2025Hustle: Does not sanitise and escape some of its settingsCVE-2024-8492 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Hustle
- Affected
- up to 7.8.5
- What to do
- Affects up to 7.8.5. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.8
- What to do
- Update Page Builder: Pagelayer to 1.8.8 or newer.
May 15, 2025webtoffee-gdpr-cookie-consent: Does not properly sanitize and escape the IP headersCVE-2024-8397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
- Product
- webtoffee-gdpr-cookie-consent
- Fixed in
- 2.6.1
- What to do
- Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Download Manager
- Fixed in
- 3.2.99
- What to do
- Update Download Manager to 3.2.99 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Post Show
- Fixed in
- 3.0.1
- What to do
- Update Smart Post Show to 3.0.1 or newer.
May 15, 2025ClickSold IDX: Does not sanitise and escape some of its settingsCVE-2024-7769 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- ClickSold IDX
- Affected
- up to 1.90
- What to do
- Affects up to 1.90. Update ClickSold IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PWA for WP: Does not sanitise and escape some of its settingsCVE-2024-7759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- PWA for WP
- Fixed in
- 1.7.72
- What to do
- Update PWA for WP to 1.7.72 or newer.
May 15, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-7758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Stylish Price List
- Fixed in
- 7.1.8
- What to do
- Update Stylish Price List to 7.1.8 or newer.
May 15, 2025Simple Share: Does not sanitise and escape some of its settingsCVE-2024-7556 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Share
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Simple Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Simple Video Directory
- Fixed in
- 1.4.3
- What to do
- Update Simple Video Directory to 1.4.3 or newer.
May 15, 2025DL Verification: Does not sanitise and escape some of its settingsCVE-2024-6798 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025DL Robots.txt: Does not sanitise and escape some of its settingsCVE-2024-6797 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Robots.txt
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Robots.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PVN Auth Popup: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PVN Auth Popup: Does not sanitise and escape some of its settingsCVE-2024-6713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Event Tickets with Ticket Scanner: Does not sanitise and escape some parametersCVE-2024-6711 · WordPress plugins & themes · reported by WPScanLow 3.5
The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.3.8
- What to do
- Update Event Tickets with Ticket Scanner to 2.3.8 or newer.
May 15, 2025User Profile Builder: Does not sanitise and escape some parameters before outputting its content on the admin areaCVE-2024-6708 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
- Product
- User Profile Builder
- Fixed in
- 3.12.2
- What to do
- Update User Profile Builder to 3.12.2 or newer.
May 15, 2025wccp-pro: Does not sanitise and escape some of its settingsCVE-2024-6693 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- wccp-pro
- Fixed in
- 15.3
- What to do
- Update wccp-pro to 15.3 or newer.
May 15, 2025ProfilePro: Does not sanitise and escape some parameters and lacks proper access controlsCVE-2024-6668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks
- Product
- ProfilePro
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ProfilePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6667 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin.
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.5
- What to do
- Update KBucket: Your Curated Content in to 4.1.5 or newer.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape some of its settingsCVE-2024-6665 · WordPress plugins & themes · reported by WPScanMedium 4.8
The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.6
- What to do
- Update KBucket: Your Curated Content in to 4.1.6 or newer.
May 15, 2025CTT Expresso para WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-6478 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CTT Expresso para WooCommerce
- Fixed in
- 3.2.13
- What to do
- Update CTT Expresso para WooCommerce to 3.2.13 or newer.
May 15, 2025DL Yandex Metrika: Does not sanitise and escape some of its settingsCVE-2024-6462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DL Yandex Metrika
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Yandex Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Tracking Code Manager: Does not sanitise and escape some of its settingsCVE-2024-6335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tracking Code Manager
- Fixed in
- 2.3.0
- What to do
- Update Tracking Code Manager to 2.3.0 or newer.
May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Push Notification for Post and BuddyPress
- Fixed in
- 1.9.4
- What to do
- Update Push Notification for Post and BuddyPress to 1.9.4 or newer.
May 15, 2025If-So Dynamic Content Personalization: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5440 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.3
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.3 or newer.
May 15, 2025CM Tooltip Glossary: Does not sanitise and escape some of its settingsCVE-2024-5026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CM Tooltip Glossary
- Fixed in
- 4.3.4
- What to do
- Update CM Tooltip Glossary to 4.3.4 or newer.
May 15, 2025Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-4091 · WordPress plugins & themes · reported by WPScanLow 3.5
The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.15
- What to do
- Update Responsive Gallery Grid to 2.3.15 or newer.
May 15, 2025Advanced Cron Manager: Does not sanitise and escape some of its settingsCVE-2024-4004 · WordPress plugins & themes · reported by WPScanLow 3.5
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Cron Manager
- Fixed in
- 2.5.7
- What to do
- Update Advanced Cron Manager to 2.5.7 or newer.
May 15, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-4002 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.6.9
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.6.9 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-3996 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Post Show
- Fixed in
- 2.4.28
- What to do
- Update Smart Post Show to 2.4.28 or newer.
May 15, 2025Genesis Blocks: Does not properly escape attributes provided to some of its custom blocksCVE-2024-3901 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
- Product
- Genesis Blocks
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Genesis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Save as Image Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2024-3062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as Image Plugin by Pdfcrowd
- Fixed in
- 3.2.2
- What to do
- Update Save as Image Plugin by Pdfcrowd to 3.2.2 or newer.
May 15, 2025Easy Property Listings: Does not sanitise and escape some of its settingsCVE-2024-2869 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
May 15, 2025Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-2643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.6.8
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.6.8 or newer.
May 15, 2025Ultimate Noindex Nofollow Tool II: Does not sanitise and escape some of its settingsCVE-2024-1663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Noindex Nofollow Tool II
- Fixed in
- 1.3.6
- What to do
- Update Ultimate Noindex Nofollow Tool II to 1.3.6 or newer.
May 15, 2025S3Player: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13865 · WordPress plugins & themes · reported by WPScanMedium 6.1
The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- S3Player
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update S3Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Badgearoo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13828 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025360 Product Rotation: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13823 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- 360 Product Rotation
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update 360 Product Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.