Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

366new WordPress flaws this week

393,576entries in the database

11,333 results · page 181 of 227

May 16, 2024Tutor LMS Pro: Unauthorized access of data, modification of data, loss of dataCVE-2024-4222 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.
Product
Tutor LMS Pro
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeum.com wordfence.com
May 15, 2024The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongingCVE-2024-3749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2024SP Project & Document Manager: Is missing validation in its upload functionCVE-2024-3748 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease: Sensitive Information ExposureCVE-2024-0437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticated attackers, with subscriber access or higher, to extract post titles and content, thus bypassing the plugin's password protection.
Product
Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Leyka: Improper Privilege ManagementCVE-2023-33327 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.
Product
Leyka
Affected
up to 3.30.2
What to do
Affects up to 3.30.2. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Propovoice CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4747 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Propovoice Propovoice CRM allows Stored XSS.This issue affects Propovoice CRM: from n/a through 1.7.6.2.
Product
Propovoice CRM
Affected
up to 1.7.6.2
What to do
Affects up to 1.7.6.2. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Elementor Website Builder – More than Just a Page Builder Pro: Stored Cross-Site ScriptingCVE-2024-4107 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Website Builder – More than Just a Page Builder Pro
Affected
up to 3.21.0
What to do
Affects up to 3.21.0. Update Elementor Website Builder – More than Just a Page Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record doc.clickup.com wordfence.com
May 14, 2024The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for: Arbitrary shortcode executionCVE-2024-4038 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.3.1. This is due to the plugin for WordPress allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Spectra Pro: Privilege escalationCVE-2024-3828 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lower-privileged users to create registration forms and set the default role to administrator This makes it possible for authenticated attackers, with author-level access and above, to create administrator-level accounts.
Product
Spectra Pro
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Spectra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpspectra.com wordfence.com
May 14, 2024Sticky banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidden Depth Sticky banner allows Stored XSS.This issue affects Sticky banner: from n/a through 1.2.0.
Product
Sticky banner
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Sticky banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024All Bootstrap Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35169 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.15.
Product
All Bootstrap Blocks
Affected
up to 1.3.15
What to do
Affects up to 1.3.15. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Envo's Elementor Templates & Widgets for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35167 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through 1.4.8.
Product
Envo's Elementor Templates & Widgets for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Envo's Elementor Templates & Widgets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34811 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.
Product
WP SMS
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34445 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8.
Product
SKT Addons for Elementor
Affected
up to 1.8
What to do
Affects up to 1.8. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Easy Affiliate Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34441 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures Easy Affiliate Links allows Stored XSS.This issue affects Easy Affiliate Links: from n/a through 3.7.2.
Product
Easy Affiliate Links
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update Easy Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34437 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.24.
Product
Form Maker by 10Web
Affected
up to 1.15.24
What to do
Affects up to 1.15.24. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34436 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8.
Product
SKT Addons for Elementor
Affected
up to 1.8
What to do
Affects up to 1.8. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Better Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34432 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons better-elementor-addons allows Stored XSS.This issue affects Better Elementor Addons: from n/a through 1.4.4.
Product
Better Elementor Addons
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Better Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP etracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue affects WP etracker: from n/a through 1.0.2.
Product
WP etracker
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP etracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024TT Custom Post Type Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34430 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rashed Latif TT Custom Post Type Creator allows Stored XSS.This issue affects TT Custom Post Type Creator: from n/a through 1.0.
Product
TT Custom Post Type Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update TT Custom Post Type Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Corona Virus (COVID-19) Banner & Live Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data allows Stored XSS.This issue affects Corona Virus (COVID-19) Banner & Live Data: from n/a through 1.8.0.2.
Product
Corona Virus (COVID-19) Banner & Live Data
Affected
up to 1.8.0.2
What to do
Affects up to 1.8.0.2. Update Corona Virus (COVID-19) Banner & Live Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024AWSOM News Announcement: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34428 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harknell AWSOM News Announcement allows Stored XSS.This issue affects AWSOM News Announcement: from n/a through 1.6.0.
Product
AWSOM News Announcement
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update AWSOM News Announcement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Brozzme Scroll Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34426 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue affects Brozzme Scroll Top: from n/a through 1.8.5.
Product
Brozzme Scroll Top
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Brozzme Scroll Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024QuickieBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34425 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Baylog QuickieBar allows Stored XSS.This issue affects QuickieBar: from n/a through 1.8.4.
Product
QuickieBar
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update QuickieBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Featured Content Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34424 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iePlexus Featured Content Gallery allows Stored XSS.This issue affects Featured Content Gallery: from n/a through 3.2.0.
Product
Featured Content Gallery
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Featured Content Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Forty Four – 404 Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34423 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpbits Forty Four – 404 Plugin for WordPress allows Stored XSS.This issue affects Forty Four – 404 Plugin for WordPress: from n/a through 1.4.
Product
Forty Four – 404 Plugin for
Affected
up to 1.4
What to do
Affects up to 1.4. Update Forty Four – 404 Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Viet Affiliate Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trinhtuantai Viet Affiliate Link allows Stored XSS.This issue affects Viet Affiliate Link: from n/a through 1.2.
Product
Viet Affiliate Link
Affected
up to 1.2
What to do
Affects up to 1.2. Update Viet Affiliate Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024BlogLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34421 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsurface BlogLentor allows Stored XSS.This issue affects BlogLentor: from n/a through 1.0.8.
Product
BlogLentor
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update BlogLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Comments Evolved for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34420 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in talspotim Comments Evolved for WordPress allows Stored XSS.This issue affects Comments Evolved for WordPress: from n/a through 1.6.3.
Product
Comments Evolved for
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Comments Evolved for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Configure Login Timeout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34419 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nathan Vonnahme Configure Login Timeout allows Stored XSS.This issue affects Configure Login Timeout: from n/a through 1.0.
Product
Configure Login Timeout
Affected
up to 1.0
What to do
Affects up to 1.0. Update Configure Login Timeout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WPCS ( WordPress Custom Search ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34418 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tech9logy Creators WPCS ( WordPress Custom Search ) allows Stored XSS.This issue affects WPCS ( WordPress Custom Search ): from n/a through 1.1.
Product
WPCS ( WordPress Custom Search )
Affected
up to 1.1
What to do
Affects up to 1.1. Update WPCS ( WordPress Custom Search ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Viet Nam Affiliate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34417 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toidicode.Com (thanhtaivtt) Viet Nam Affiliate allows Stored XSS.This issue affects Viet Nam Affiliate: from n/a through 1.0.0.
Product
Viet Nam Affiliate
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Viet Nam Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Thim Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34415 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit allows Stored XSS.This issue affects Thim Elementor Kit: from n/a through 1.1.8.
Product
Thim Elementor Kit
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Freesia Empire: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33955 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Freesia Empire allows Stored XSS.This issue affects Freesia Empire: from n/a through 1.4.1.
Product
Freesia Empire
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Freesia Empire to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Pliska: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Yonkov Pliska allows Stored XSS.This issue affects Pliska: from n/a through 0.3.5.
Product
Pliska
Affected
up to 0.3.5
What to do
Affects up to 0.3.5. Update Pliska to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Adventure Journal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt van Andel Adventure Journal allows Stored XSS.This issue affects Adventure Journal: from n/a through 1.7.2.
Product
Adventure Journal
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Adventure Journal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Unique: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Unique allows Stored XSS.This issue affects Unique: from n/a through 0.3.0.
Product
Unique
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update Unique to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Perfect Pullquotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam DeHaven Perfect Pullquotes allows Stored XSS.This issue affects Perfect Pullquotes: from n/a through 1.7.5.
Product
Perfect Pullquotes
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Perfect Pullquotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permittingCVE-2024-2749 · WordPress plugins & themes · reported by WPScanMedium 5.9
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.
Fixed in
1.6.8
What to do
Update the plugin to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024SP Project & Document Manager: Unauthorized modification of dataCVE-2024-1693 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.
Product
SP Project & Document Manager
Affected
up to 4.70
What to do
Affects up to 4.70. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 8, 2024EPROLO Dropshipping: Missing AuthorizationCVE-2024-33573 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1.
Product
EPROLO Dropshipping
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update EPROLO Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34561 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Stored XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.71.
Product
3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
Affected
up to 3.71
What to do
Affects up to 3.71. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024gee Search Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34560 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GOMO gee Search Plus allows Stored XSS.This issue affects gee Search Plus: from n/a through 1.4.4.
Product
gee Search Plus
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update gee Search Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024WOLF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34558 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF: from n/a through 1.0.8.2.
Product
WOLF
Affected
up to 1.0.8.2
What to do
Affects up to 1.0.8.2. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Stockholm Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This issue affects Stockholm Core: from n/a through 2.4.1.
Product
Stockholm Core
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Stockholm Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024WidgetKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.4.8.
Product
WidgetKit
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through 1.1.34.
Product
Magical Addons For Elementor
Affected
up to 1.1.34
What to do
Affects up to 1.1.34. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Sticky Social Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34546 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allows DOM-Based XSS.This issue affects Sticky Social Link: from n/a through <= 2.0.1.
Product
Sticky Social Link
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Sticky Social Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024raindrops: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34414 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nobita allows Stored XSS.This issue affects raindrops: from n/a through 1.600.
Product
raindrops
Affected
up to 1.600
What to do
Affects up to 1.600. Update raindrops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34570 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.3.
Product
Xpro Elementor Addons
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.