Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

12,494 results · page 172 of 250

Oct 5, 2024Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 1.8.2.
Product
Search Atlas SEO
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47386 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.8.
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Essential Blocks for Gutenberg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47385 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.4.
Product
Essential Blocks for Gutenberg
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Compress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47384 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.This issue affects WP Compress: from n/a through <= 6.20.13.
Product
WP Compress
Affected
up to 6.20.13
What to do
Affects up to 6.20.13. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47383 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.0.8.8.
Product
The Pack Elementor addons
Affected
up to 2.0.8.8
What to do
Affects up to 2.0.8.8. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Page-list: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47382 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.6.
Product
Page-list
Affected
up to 5.6
What to do
Affects up to 5.6. Update Page-list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Depicter Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47381 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Depicter Slider depicter allows Stored XSS.This issue affects Depicter Slider: from n/a through <= 3.2.2.
Product
Depicter Slider
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP-Lister Lite for eBay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47380 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Reflected XSS.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.6.3.
Product
WP-Lister Lite for eBay
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Web Directory Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.3.
Product
Web Directory Free
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Web Directory Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WPCOM Member: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lomu WPCOM Member wpcom-member allows Reflected XSS.This issue affects WPCOM Member: from n/a through <= 1.5.4.
Product
WPCOM Member
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47630 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.7.
Product
ElementInvader Addons for Elementor
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47629 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.0.5.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47628 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.3.9.3.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.3.9.3
What to do
Affects up to 1.3.9.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Travel Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47627 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.6.0.
Product
WP Travel Gutenberg Blocks
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update WP Travel Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024RTMKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47626 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.5.0.
Product
RTMKit
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Enter Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47625 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.8.
Product
Enter Addons
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Enter Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Helpie FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47647 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Essekia Helpie FAQ helpie-faq allows Stored XSS.This issue affects Helpie FAQ: from n/a through <= 1.27.
Product
Helpie FAQ
Affected
up to 1.27
What to do
Affects up to 1.27. Update Helpie FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Copyscape Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47644 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Copyscape Copyscape Premium copyscape-premium allows Stored XSS.This issue affects Copyscape Premium: from n/a through <= 1.3.9.
Product
Copyscape Premium
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Copyscape Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Include Fussball.de Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47643 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Include Fussball.de Widgets include-fussball-de-widgets allows Stored XSS.This issue affects Include Fussball.de Widgets: from n/a through <= 4.0.0.
Product
Include Fussball.de Widgets
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Include Fussball.de Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Keap Official Opt-in Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms infusionsoft-official-opt-in-forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through <= 2.0.3.
Product
Keap Official Opt-in Forms
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024VdoCipher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vibhav Sinha VdoCipher vdocipher allows Stored XSS.This issue affects VdoCipher: from n/a through <= 1.29.
Product
VdoCipher
Affected
up to 1.29
What to do
Affects up to 1.29. Update VdoCipher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.4.6.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Zoho Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47633 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Zoho Forms zoho-forms allows Stored XSS.This issue affects Zoho Forms: from n/a through <= 4.0.
Product
Zoho Forms
Affected
up to 4.0
What to do
Affects up to 4.0. Update Zoho Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.7.
Product
DethemeKit For Elementor
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Logo Carousel – Clients logo carousel for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for WP: from n/a through <= 1.2.
Product
Logo Carousel – Clients logo carousel for WP
Affected
up to 1.2
What to do
Affects up to 1.2. Update Logo Carousel – Clients logo carousel for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Newsletter Subscription: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44012 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
Product
WP Newsletter Subscription
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Newsletter Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Shortcodes and extra features for Phlox: Stored Cross-Site ScriptingCVE-2024-8486 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in the Modern Heading and Icon Picker widgets all versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.16.3
What to do
Affects up to 2.16.3. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 5, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Limited JavaScript File UploadCVE-2024-8743 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
Affected
up to 6.5.7
What to do
Affects up to 6.5.7. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-9528 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024WP Cleanup and Basic Functions: Stored Cross-Site ScriptingCVE-2024-9455 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Cleanup and Basic Functions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Cleanup and Basic Functions
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WP Cleanup and Basic Functions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 4, 2024Themify Builder: Reflected Cross-Site ScriptingCVE-2024-9385 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Themify Builder
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Checkout Field Editor (Checkout Manager) for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-8499 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Checkout Field Editor (Checkout Manager) for WooCommerce
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Checkout Field Editor (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Re:WP: Stored Cross-Site ScriptingCVE-2024-9271 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Re:WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Re:WP
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Re:WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 4, 2024Easy Demo Importer – A Modern One-Click Demo Import Solution: Stored Cross-Site ScriptingCVE-2024-9071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Easy Demo Importer – A Modern One-Click Demo Import Solution
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Easy Demo Importer – A Modern One-Click Demo Import Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 4, 2024ShiftController Employee Shift Scheduling: Reflected Cross-Site ScriptingCVE-2024-9435 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versions up to, and including, 4.9.66 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ShiftController Employee Shift Scheduling
Affected
up to 4.9.66
What to do
Affects up to 4.9.66. Update ShiftController Employee Shift Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024WP Booking Calendar: Stored Cross-Site ScriptingCVE-2024-9306 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. In addition, site administrators have the option to grant lower-level users with access to manage the plugin's settings which may extend this vulnerability to those users.
Product
WP Booking Calendar
Affected
up to 10.6
What to do
Affects up to 10.6. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2024Memberful – Membership: Stored Cross-Site ScriptingCVE-2024-9242 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscription_link' and 'memberful_podcasts_link' shortcodes in all versions up to, and including, 1.73.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Memberful – Membership
Affected
up to 1.73.7
What to do
Affects up to 1.73.7. Update Memberful – Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Code Embed: Stored Cross-Site ScriptingCVE-2024-8804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions on who can utilize the functionality. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Code Embed
Affected
up to 2.4
What to do
Affects up to 2.4. Update Code Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2024Display Medium Posts: Stored Cross-Site ScriptingCVE-2024-9445 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Display Medium Posts
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update Display Medium Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 4, 2024Login Logout Shortcode: Stored Cross-Site ScriptingCVE-2024-9421 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login Logout Shortcode
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Login Logout Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 4, 2024Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9384 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Quantity Dynamic Pricing & Bulk Discounts for WooCommerce
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Quantity Dynamic Pricing & Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024WordPress Captcha Plugin by Captcha Bank: Reflected Cross-Site ScriptingCVE-2024-9375 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WordPress Captcha Plugin by Captcha Bank
Affected
up to 4.0.36
What to do
Affects up to 4.0.36. Update WordPress Captcha Plugin by Captcha Bank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2024WP Blocks Hub: Stored Cross-Site ScriptingCVE-2024-9372 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Blocks Hub
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Blocks Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 4, 2024Aggregator Advanced Settings: Stored Cross-Site ScriptingCVE-2024-9368 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Aggregator Advanced Settings
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Aggregator Advanced Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 4, 2024Popularis Extra: Reflected Cross-Site ScriptingCVE-2024-9353 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Popularis Extra
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Popularis Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Auto Amazon Links – Amazon Associates Affiliate: Reflected Cross-Site ScriptingCVE-2024-9349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Auto Amazon Links – Amazon Associates Affiliate
Affected
up to 5.4.2
What to do
Affects up to 5.4.2. Update Auto Amazon Links – Amazon Associates Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Product Delivery Date for WooCommerce – Lite: Reflected Cross-Site ScriptingCVE-2024-9345 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when notices are present.
Product
Product Delivery Date for WooCommerce – Lite
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate: Reflected Cross-Site ScriptingCVE-2024-9237 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Smart Custom 404 Error Page: Reflected Cross-Site ScriptingCVE-2024-9204 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and including, 11.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Smart Custom 404 Error Page
Affected
up to 11.4.7
What to do
Affects up to 11.4.7. Update Smart Custom 404 Error Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Clio Grow: Reflected Cross-Site ScriptingCVE-2024-8802 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Clio Grow
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Clio Grow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.