Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

15,554 results · page 207 of 312

Aug 2, 2024Spectra Pro: Stored Cross-Site ScriptingCVE-2024-3827 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spectra Pro
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Spectra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpspectra.com wordfence.com
Aug 1, 2024Message Filter for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39647 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.1.1.
Product
Message Filter for Contact Form 7
Affected
up to 1.6.1.1
What to do
Affects up to 1.6.1.1. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Custom 404 Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Custom 404 Pro: from n/a through <= 3.11.1.
Product
Custom 404 Pro
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows Stored XSS.This issue affects Black Widgets For Elementor: from n/a through 1.3.5.
Product
Black Widgets For Elementor
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024RegistrationMagic: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39643 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RegistrationMagic Forms RegistrationMagic allows Stored XSS.This issue affects RegistrationMagic: from n/a through 6.0.0.1.
Product
RegistrationMagic
Affected
up to 6.0.0.1
What to do
Affects up to 6.0.0.1. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.
Product
Contest Gallery
Affected
up to 23.1.2
What to do
Affects up to 23.1.2. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Himalayas: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39629 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.2.
Product
Himalayas
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Himalayas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024NextGEN Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39627 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Imagely NextGEN Gallery allows Stored XSS.This issue affects NextGEN Gallery: from n/a through 3.59.3.
Product
NextGEN Gallery
Affected
up to 3.59.3
What to do
Affects up to 3.59.3. Update NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Pretty Simple Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39626 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob @ 5 Star Plugins Pretty Simple Popup Builder pretty-simple-popup-builder allows Stored XSS.This issue affects Pretty Simple Popup Builder: from n/a through <= 1.0.9.
Product
Pretty Simple Popup Builder
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Pretty Simple Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Extensions for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39668 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Stored XSS.This issue affects Extensions for Elementor: from n/a through 2.0.31.
Product
Extensions for Elementor
Affected
up to 2.0.31
What to do
Affects up to 2.0.31. Update Extensions for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39667 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.6.11.
Product
Element Pack Elementor Addons
Affected
up to 5.6.11
What to do
Affects up to 5.6.11. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Filter & Grids: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YMC Filter & Grids allows Stored XSS.This issue affects Filter & Grids: from n/a through 2.9.2.
Product
Filter & Grids
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024WP Fast Total Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39663 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.68.232.
Product
WP Fast Total Search
Affected
up to 1.68.232
What to do
Affects up to 1.68.232. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows Stored XSS.This issue affects Black Widgets For Elementor: from n/a through 1.3.5.
Product
Black Widgets For Elementor
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Kubio AI Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39661 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ExtendThemes Kubio AI Page Builder.This issue affects Kubio AI Page Builder: from n/a through 2.2.4.
Product
Kubio AI Page Builder
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Photo Engine: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39660 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jordy Meow Photo Engine allows Stored XSS.This issue affects Photo Engine: from n/a through 6.3.1.
Product
Photo Engine
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Photo Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024WP-PostRatings: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39659 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1.
Product
WP-PostRatings
Affected
up to 1.91.1
What to do
Affects up to 1.91.1. Update WP-PostRatings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Tin Canny Reporting for LearnDash: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Tin Canny Reporting for LearnDash allows Reflected XSS.This issue affects Tin Canny Reporting for LearnDash: from n/a through 4.3.0.7.
Product
Tin Canny Reporting for LearnDash
Affected
up to 4.3.0.7
What to do
Affects up to 4.3.0.7. Update Tin Canny Reporting for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024LiquidPoll – Advanced Polls for Creators and Brands: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39655 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.77.
Product
LiquidPoll – Advanced Polls for Creators and Brands
Affected
up to 3.3.77
What to do
Affects up to 3.3.77. Update LiquidPoll – Advanced Polls for Creators and Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024WooCommerce PDF Vouchers: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Reflected XSS.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
Product
WooCommerce PDF Vouchers
Fixed in
4.9.5
What to do
Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite.This issue affects Essential Addons for Elementor: from n/a through <= 5.9.26.
Product
Essential Addons for Elementor
Affected
up to 5.9.26
What to do
Affects up to 5.9.26. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Eventin: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39648 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5.
Product
Eventin
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39624 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
Product
ListingPro
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39621 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
Product
ListingPro
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39619 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
Product
ListingPro
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Element Pack - Addon for Elementor Page Builder: Stored Cross-Site ScriptingCVE-2024-2455 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack - Addon for Elementor Page Builder
Affected
up to 7.9.0
What to do
Affects up to 7.9.0. Update Element Pack - Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record feedback.elementpack.pro feedback.elementpack.pro
Aug 1, 2024Gutenberg Blocks, Page Builder – ComboBlocks: Stored Cross-Site ScriptingCVE-2024-6346 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Countdown widget, in all versions up to, and including, 2.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenberg Blocks, Page Builder – ComboBlocks
Affected
up to 2.2.85
What to do
Affects up to 2.2.85. Update Gutenberg Blocks, Page Builder – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024Blog2Social: Social Media Auto Post & Scheduler: Stored Cross-Site ScriptingCVE-2024-7302 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024Breakdance: Stored Cross-Site ScriptingCVE-2024-5330 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdance_css_file_paths_cache parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Breakdance
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Breakdance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record breakdance.com wordfence.com
Aug 1, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6529 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ultimate Classified Listings
Fixed in
1.4
What to do
Update Ultimate Classified Listings to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-4090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.7.2
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024socialdriver-framework: Does not sanitise and escape some of its settingsCVE-2024-2872 · WordPress plugins & themes · reported by WPScanMedium 4.8
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
socialdriver-framework
Fixed in
2024.04.30
What to do
Update socialdriver-framework to 2024.04.30 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2024Download Manager: Stored Cross-Site ScriptingCVE-2024-6208 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.2.97
What to do
Affects up to 3.2.97. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2024-6725 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Affected
up to 6.11.1
What to do
Affects up to 6.11.1. Update Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2024Lifetime free Drag & Drop Contact Form Builder for WordPress VForm: Stored Cross-Site ScriptingCVE-2024-6770 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lifetime free Drag & Drop Contact Form Builder for WordPress VForm
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Lifetime free Drag & Drop Contact Form Builder for WordPress VForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2024SpiderContacts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
SpiderContacts
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update SpiderContacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 31, 2024WANotifier: Does not sanitise and escape some of its settingsCVE-2024-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WANotifier
Fixed in
2.6.1
What to do
Update WANotifier to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-5901 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SiteOrigin Widgets Bundle
Affected
up to 1.62.2
What to do
Affects up to 1.62.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 30, 2024Bold Page Builder: Stored Cross-Site ScriptingCVE-2024-7100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 30, 2024Zephyr Project Manager: Does not sanitise and escape some of its settingsCVE-2024-6536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Zephyr Project Manager
Fixed in
3.3.99
What to do
Update Zephyr Project Manager to 3.3.99 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024WpStickyBar: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6226 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WpStickyBar
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024Send email only on Reply to My Comment: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6223 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Send email only on Reply to My Comment
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024WP Ajax Contact Form: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5809 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users
Product
WP Ajax Contact Form
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024Responsive Tabs: Does not sanitise and escape some of its Tab settingsCVE-2024-4096 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024SportsPress: Does not sanitise and escape some of its settingsCVE-2024-3986 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
SportsPress
Fixed in
2.7.22
What to do
Update SportsPress to 2.7.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024Web Directory Free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3669 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Web Directory Free
Fixed in
1.7.2
What to do
Update Web Directory Free to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection: Does not sanitise and escape some of its settingsCVE-2024-3113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection
Fixed in
2.12.2
What to do
Update FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-6487 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Inline Related Posts
Fixed in
3.8.0
What to do
Update Inline Related Posts to 3.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2024Ultimate Blocks: Does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embedCVE-2024-6362 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.2.0
What to do
Update Ultimate Blocks to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5883 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ultimate Classified Listings
Fixed in
1.3
What to do
Update Ultimate Classified Listings to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.