Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

359new WordPress flaws this week

393,576entries in the database

11,333 results · page 186 of 227

Apr 18, 2024WP Dummy Content Generator: Improper Control of Generation of Code ('Code Injection')CVE-2024-32599 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator.This issue affects WP Dummy Content Generator: from n/a through <= 3.2.1.
Product
WP Dummy Content Generator
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024BA Book Everything: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32598 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.
Product
BA Book Everything
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WordPress Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32597 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7.
Product
WordPress Importer
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update WordPress Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024DSGVO Youtube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32596 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube allows Stored XSS.This issue affects DSGVO Youtube: from n/a through 1.4.5.
Product
DSGVO Youtube
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update DSGVO Youtube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WP Helper Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32595 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mat Bao Corp WP Helper Premium allows Reflected XSS.This issue affects WP Helper Premium: from n/a before 4.6.0.
Product
WP Helper Premium
Fixed in
4.6.0
What to do
Update WP Helper Premium to 4.6.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Attesa Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP Attesa Extra allows Stored XSS.This issue affects Attesa Extra: from n/a through 1.3.9.
Product
Attesa Extra
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Attesa Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WPBITS Addons For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through 1.3.4.2.
Product
WPBITS Addons For Elementor Page Builder
Affected
up to 1.3.4.2
What to do
Affects up to 1.3.4.2. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Void Elementor WHMCS Elements For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VoidCoders, innovs Void Elementor WHMCS Elements For Elementor Page Builder allows Stored XSS.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from n/a through 2.0.
Product
Void Elementor WHMCS Elements For Elementor Page Builder
Affected
up to 2.0
What to do
Affects up to 2.0. Update Void Elementor WHMCS Elements For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Backend Designer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32591 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele De Rosa Backend Designer allows Stored XSS.This issue affects Backend Designer: from n/a through 1.3.
Product
Backend Designer
Affected
up to 1.3
What to do
Affects up to 1.3. Update Backend Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Kattene: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32590 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webfood Kattene allows Stored XSS.This issue affects Kattene: from n/a through 1.7.
Product
Kattene
Affected
up to 1.7
What to do
Affects up to 1.7. Update Kattene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024LearnPress Export Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32588 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through 4.0.3.
Product
LearnPress Export Import
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024EnvíaloSimple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32587 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvialoSimple EnvíaloSimple allows Reflected XSS.This issue affects EnvíaloSimple: from n/a through 2.2.
Product
EnvíaloSimple
Affected
up to 2.2
What to do
Affects up to 2.2. Update EnvíaloSimple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024PeproDev CF7 Database: Cross-Site Request Forgery (CSRF)CVE-2023-41864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0.
Product
PeproDev CF7 Database
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update PeproDev CF7 Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Otter Blocks: Does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered blockCVE-2024-2729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
Product
Otter Blocks
Fixed in
2.6.6
What to do
Update Otter Blocks to 2.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024JS Help Desk – Best Help Desk & Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47151 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024GuCherry Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32531 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest themes GuCherry Blog allows Reflected XSS.This issue affects GuCherry Blog: from n/a through 1.1.8.
Product
GuCherry Blog
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update GuCherry Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32530 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5.
Product
Simple Testimonials Showcase
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Yoga Schedule Momoyoga: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Momoyoga Yoga Schedule Momoyoga allows Stored XSS.This issue affects Yoga Schedule Momoyoga: from n/a through 2.7.0.
Product
Yoga Schedule Momoyoga
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Yoga Schedule Momoyoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP Dynamic Keywords Injector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32528 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seerox WP Dynamic Keywords Injector allows Reflected XSS.This issue affects WP Dynamic Keywords Injector: from n/a through 2.3.18.
Product
WP Dynamic Keywords Injector
Affected
up to 2.3.18
What to do
Affects up to 2.3.18. Update WP Dynamic Keywords Injector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Jotform Online Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jotform Jotform Online Forms allows Stored XSS.This issue affects Jotform Online Forms: from n/a through 1.3.1.
Product
Jotform Online Forms
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Jotform Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Easy Textillate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32526 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flector Easy Textillate allows Stored XSS.This issue affects Easy Textillate: from n/a through 2.02.
Product
Easy Textillate
Affected
up to 2.02
What to do
Affects up to 2.02. Update Easy Textillate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP Cost Estimation & Payment Forms Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Loopus WP Cost Estimation & Payment Forms Builder allows Reflected XSS.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75.
Product
WP Cost Estimation & Payment Forms Builder
Affected
up to 10.1.75
What to do
Affects up to 10.1.75. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32508 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.
Product
DethemeKit For Elementor
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.0.6.
Product
ElementsKit Elementor addons Lite
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Elements Plus!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32457 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The CSSIgniter Team Elements Plus! allows Stored XSS.This issue affects Elements Plus!: from n/a through 2.16.3.
Product
Elements Plus!
Affected
up to 2.16.3
What to do
Affects up to 2.16.3. Update Elements Plus! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Envo Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32456 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra allows Stored XSS.This issue affects Envo Extra: from n/a through 1.8.11.
Product
Envo Extra
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Payment Forms for Paystack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32130 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paystack Payment Forms for Paystack allows Stored XSS.This issue affects Payment Forms for Paystack: from n/a through 3.4.1.
Product
Payment Forms for Paystack
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Tax Rate Upload: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32546 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.
Product
Tax Rate Upload
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Tax Rate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Canva – Design beautiful blog graphics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Canva Canva – Design beautiful blog graphics allows Reflected XSS.This issue affects Canva – Design beautiful blog graphics: from n/a through 1.2.4.
Product
Canva – Design beautiful blog graphics
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Canva – Design beautiful blog graphics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Netgsm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through 2.8.
Product
Netgsm
Affected
up to 2.8
What to do
Affects up to 2.8. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024MJ Update History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minoji MJ Update History allows Reflected XSS.This issue affects MJ Update History: from n/a through 1.0.4.
Product
MJ Update History
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update MJ Update History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Bulk Block Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32542 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1.
Product
Bulk Block Converter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Bulk Block Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP-Cufon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32541 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tobias Battenberg WP-Cufon allows Stored XSS.This issue affects WP-Cufon: from n/a through 1.6.10.
Product
WP-Cufon
Affected
up to 1.6.10
What to do
Affects up to 1.6.10. Update WP-Cufon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Fixed HTML Toolbar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32540 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Web357 Fixed HTML Toolbar allows Stored XSS.This issue affects Fixed HTML Toolbar: from n/a through 1.0.7.
Product
Fixed HTML Toolbar
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Fixed HTML Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP File Download Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This issue affects WP File Download Light: from n/a through 1.3.3.
Product
WP File Download Light
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WP File Download Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP TradingView: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trade Pips WP TradingView allows Stored XSS.This issue affects WP TradingView: from n/a through 1.7.
Product
WP TradingView
Affected
up to 1.7
What to do
Affects up to 1.7. Update WP TradingView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Access Category Password: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jojaba Access Category Password allows Reflected XSS.This issue affects Access Category Password: from n/a through 1.5.1.
Product
Access Category Password
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Access Category Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.23.
Product
Form Maker by 10Web
Affected
up to 1.15.23
What to do
Affects up to 1.15.23. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024LH Add Media From Url: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Shaw LH Add Media From Url allows Reflected XSS.This issue affects LH Add Media From Url: from n/a through 1.22.
Product
LH Add Media From Url
Affected
up to 1.22
What to do
Affects up to 1.22. Update LH Add Media From Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Ninja Forms Contact Form: Improper Input ValidationCVE-2023-36505 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
Product
Ninja Forms Contact Form
Affected
up to 3.6.24
What to do
Affects up to 3.6.24. Update Ninja Forms Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024What's New Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hideki Tanaka What's New Generator allows Stored XSS.This issue affects What's New Generator: from n/a through 2.0.2.
Product
What's New Generator
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update What's New Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Code Insert Manager (Q2W3 Inc Manager): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32547 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond Code Insert Manager (Q2W3 Inc Manager) allows Reflected XSS.This issue affects Code Insert Manager (Q2W3 Inc Manager): from n/a through 2.5.3.
Product
Code Insert Manager (Q2W3 Inc Manager)
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Code Insert Manager (Q2W3 Inc Manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WPC Grouped Product for WooCommerce: Missing AuthorizationCVE-2024-32520 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Grouped Product for WooCommerce.This issue affects WPC Grouped Product for WooCommerce: from n/a through 4.4.2.
Product
WPC Grouped Product for WooCommerce
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WPC Grouped Product for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024PeproDev Ultimate Invoice: Missing AuthorizationCVE-2024-32518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.
Product
PeproDev Ultimate Invoice
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Product Feed PRO for WooCommerce: Insertion of Sensitive Information into Log FileCVE-2024-32513 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.3.1.
Product
Product Feed PRO for WooCommerce
Affected
up to 13.3.1
What to do
Affects up to 13.3.1. Update Product Feed PRO for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
Fixed in
3.4.0
What to do
Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameterCVE-2024-2102 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context.
Product
Salon booking system
Fixed in
9.6.3
What to do
Update Salon booking system to 9.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' fieldCVE-2024-2101 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is executed in the admin context.
Product
Salon booking system
Fixed in
9.6.3
What to do
Update Salon booking system to 9.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 16, 2024LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-40000 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.
Product
LiteSpeed Cache
Affected
up to 5.7
What to do
Affects up to 5.7. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.2.
Product
Exclusive Addons Elementor
Affected
up to 2.6.9.2
What to do
Affects up to 2.6.9.2. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.