Vulnerability database

15,942 results · page 195 of 319

• Nov 19, 2024(dp) AddThis: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50540 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in demixpress (dp) AddThis dp-addthis allows Stored XSS.This issue affects (dp) AddThis: from n/a through <= 1.0.2.

  Product

  (dp) AddThis

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update (dp) AddThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Show Visitor IP Address: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50538 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in irfantea Show Visitor IP Address show-visitor-ip-address allows Stored XSS.This issue affects Show Visitor IP Address: from n/a through <= 0.2.

  Product

  Show Visitor IP Address

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Show Visitor IP Address to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Smart Mockups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50537 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Marra Smart Mockups smart-mockups allows Stored XSS.This issue affects Smart Mockups: from n/a through <= 1.2.0.

  Product

  Smart Mockups

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Smart Mockups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024GDReseller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50536 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamer Ziady GDReseller gdreseller allows DOM-Based XSS.This issue affects GDReseller: from n/a through <= 1.6.

  Product

  GDReseller

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update GDReseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Step by Step: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50535 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle M Brown Step by Step step-by-step allows Stored XSS.This issue affects Step by Step: from n/a through <= 0.4.5.

  Product

  Step by Step

  Affected

  up to 0.4.5

  What to do

  Affects up to 0.4.5. Update Step by Step to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024World Prayer Time: Cross-Site Request Forgery (CSRF)CVE-2024-50534 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in techdabang World Prayer Time world-prayer-time allows Stored XSS.This issue affects World Prayer Time: from n/a through <= 2.0.

  Product

  World Prayer Time

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update World Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Domain Sharding: Cross-Site Request Forgery (CSRF)CVE-2024-50533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Garcia Domain Sharding domain-sharding allows Stored XSS.This issue affects Domain Sharding: from n/a through <= 1.2.1.

  Product

  Domain Sharding

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Domain Sharding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Events Manager Pro – extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50532 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through <= 0.1.

  Product

  Events Manager Pro – extended

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Events Manager Pro – extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WeChat Subscribers Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through <= 1.6.6.

  Product

  WeChat Subscribers Lite

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update WeChat Subscribers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Alley Elementor Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50521 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Alley Elementor Widget alley-elementor-widget allows DOM-Based XSS.This issue affects Alley Elementor Widget: from n/a through <= 1.0.7.

  Product

  Alley Elementor Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Alley Elementor Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ancient World Linked Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50520 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter J. Herrel Ancient World Linked Data ancient-world-linked-data-for-wordpress allows DOM-Based XSS.This issue affects Ancient World Linked Data: from n/a through <= 0.2.1.

  Product

  Ancient World Linked Data

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update Ancient World Linked Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Jigoshop – Store Exporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50519 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through <= 1.5.8.

  Product

  Jigoshop – Store Exporter

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Jigoshop – Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Pricer Ninja: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50518 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Pricer Ninja pricer-ninja-pricing-tables allows Stored XSS.This issue affects Pricer Ninja: from n/a through <= 2.1.0.

  Product

  Pricer Ninja

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Pricer Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ID-SK Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50517 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDSK team ID-SK Toolkit idsk-toolkit allows Stored XSS.This issue affects ID-SK Toolkit: from n/a through <= 1.7.2.

  Product

  ID-SK Toolkit

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update ID-SK Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Countdown & Clock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50516 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Countdown & Clock countdown-builder allows Stored XSS.This issue affects Countdown & Clock: from n/a through <= 3.0.8.

  Product

  Countdown & Clock

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50515 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.

  Product

  Ninja Forms

  Affected

  up to 3.8.16

  What to do

  Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50514 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.

  Product

  Ninja Forms

  Affected

  up to 3.8.16

  What to do

  Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50513 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows Stored XSS.This issue affects PostX: from n/a through <= 4.1.15.

  Product

  PostX

  Affected

  up to 4.1.15

  What to do

  Affects up to 4.1.15. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.

  Product

  Crowdsignal Dashboard – Polls, Surveys & more

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Bard: Reflected Cross-Site ScriptingCVE-2024-9830 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Bard

  Affected

  up to 2.216

  What to do

  Affects up to 2.216. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org

• Nov 19, 2024Ashe: Reflected Cross-Site ScriptingCVE-2024-9777 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Ashe

  Affected

  up to 2.243

  What to do

  Affects up to 2.243. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org

• Nov 19, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-11224 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Parallax Image

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 19, 2024GD Rating System: Stored Cross-Site ScriptingCVE-2024-11198 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extra_class’ parameter in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GD Rating System

  Affected

  up to 3.6.1

  What to do

  Affects up to 3.6.1. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 19, 2024Email Subscription Popup: Stored Cross-Site ScriptingCVE-2024-11195 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Email Subscription Popup

  Affected

  up to 1.2.22

  What to do

  Affects up to 1.2.22. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 19, 2024SVG Block: Stored Cross-Site ScriptingCVE-2024-11098 · WordPress plugins & themes · reported by WordfenceMedium 5.5

  The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  SVG Block

  Affected

  up to 1.1.24

  What to do

  Affects up to 1.1.24. Update SVG Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 19, 2024WordPress GDPR: Stored Cross-Site ScriptingCVE-2024-10388 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WordPress GDPR

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update WordPress GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwelaunch.iowordfence.com

• Nov 19, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2024-10268 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 18, 2024Photographer Connections: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52340 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MartyThornley Photographer Connections photographer-connections allows Stored XSS.This issue affects Photographer Connections: from n/a through <= 1.3.1.

  Product

  Photographer Connections

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Photographer Connections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Mage Front End Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52339 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maximilian Ruthe Mage Front End Forms mage-forms allows Stored XSS.This issue affects Mage Front End Forms: from n/a through <= 1.1.4.

  Product

  Mage Front End Forms

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Mage Front End Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024WP Responsive Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51940 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sohelwpexpert WP Responsive Video my-wp-responsive-video allows DOM-Based XSS.This issue affects WP Responsive Video: from n/a through <= 1.0.

  Product

  WP Responsive Video

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Responsive Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Stylish Internal Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51939 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Santhosh veer Stylish Internal Links stylish-internal-links allows DOM-Based XSS.This issue affects Stylish Internal Links: from n/a through <= 1.9.

  Product

  Stylish Internal Links

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Stylish Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Gameplan: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52418 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CactusThemes Gameplan gameplan allows Reflected XSS.This issue affects Gameplan: from n/a through <= 1.5.10.

  Product

  Gameplan

  Affected

  up to 1.5.10

  What to do

  Affects up to 1.5.10. Update Gameplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024ReConstruction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52417 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes ReConstruction reconstruction allows Reflected XSS.This issue affects ReConstruction: from n/a through <= 1.4.7.

  Product

  ReConstruction

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update ReConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Print PDF Generator and Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52394 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Stored XSS.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.1.6.

  Product

  Print PDF Generator and Publisher

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52389 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through <= 2.2.0.

  Product

  WP Job Portal

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Awesome Tool Tip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52349 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Awesome Tool Tip awesome-tool-tip allows DOM-Based XSS.This issue affects Awesome Tool Tip: from n/a through <= 1.0.

  Product

  Awesome Tool Tip

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Awesome Tool Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024AA Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52348 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Extensions AA Audio Player aa-audio-player allows DOM-Based XSS.This issue affects AA Audio Player: from n/a through <= 1.0.

  Product

  AA Audio Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update AA Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52347 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera wp-website-creator allows Stored XSS.This issue affects Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: from n/a through <= 4.0.

  Product

  Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024SimpleGMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52346 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JavierMendezPWG SimpleGMaps simplegmaps allows Stored XSS.This issue affects SimpleGMaps: from n/a through <= 1.0.

  Product

  SimpleGMaps

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update SimpleGMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024ra_qrcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52345 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RobertoAlicata ra_qrcode ra-qrcode allows Stored XSS.This issue affects ra_qrcode: from n/a through <= 2.1.0.

  Product

  ra_qrcode

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update ra_qrcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Provide Forex Signals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52344 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeies Pvt Ltd Provide Forex Signals provide-forex-signals allows Stored XSS.This issue affects Provide Forex Signals: from n/a through <= 1.0.

  Product

  Provide Forex Signals

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Provide Forex Signals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024OS Pricing Tables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52343 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Pricing Tables os-pricing-tables allows Stored XSS.This issue affects OS Pricing Tables: from n/a through <= 1.2.

  Product

  OS Pricing Tables

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update OS Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024OS BXSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52342 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allows Stored XSS.This issue affects OS BXSlider: from n/a through <= 2.6.

  Product

  OS BXSlider

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update OS BXSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024OS Our Team: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52341 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Our Team os-our-team allows Stored XSS.This issue affects OS Our Team: from n/a through <= 1.7.

  Product

  OS Our Team

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update OS Our Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Linear: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52426 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue affects Linear: from n/a through <= 2.8.0.

  Product

  Linear

  Affected

  up to 2.8.0

  What to do

  Affects up to 2.8.0. Update Linear to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Drozd – Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52425 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladislav Urchenko Drozd – Addons for Elementor drozd-addons-for-elementor allows Stored XSS.This issue affects Drozd – Addons for Elementor: from n/a through <= 1.1.1.

  Product

  Drozd – Addons for Elementor

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Drozd – Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024wp-login customizer: Cross-Site Request Forgery (CSRF)CVE-2024-52424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through <= 1.0.

  Product

  wp-login customizer

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update wp-login customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Themify Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52423 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored XSS.This issue affects Themify Builder: from n/a through <= 7.6.5.

  Product

  Themify Builder

  Affected

  up to 7.6.5

  What to do

  Affects up to 7.6.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024WP Githuber MD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52422 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP Githuber MD wp-githuber-md allows Stored XSS.This issue affects WP Githuber MD: from n/a through <= 1.16.3.

  Product

  WP Githuber MD

  Affected

  up to 1.16.3

  What to do

  Affects up to 1.16.3. Update WP Githuber MD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 18, 2024Copy Anything to Clipboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52419 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clipboard Agency Copy Anything to Clipboard copy-the-code allows Stored XSS.This issue affects Copy Anything to Clipboard: from n/a through <= 4.0.3.

  Product

  Copy Anything to Clipboard

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Copy Anything to Clipboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.