Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

15,554 results · page 212 of 312

Jul 16, 2024Premium Portfolio Features for Phlox: Stored Cross-Site ScriptingCVE-2024-3587 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Portfolio Features for Phlox
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Premium Portfolio Features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2024-2691 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.43
What to do
Affects up to 3.1.43. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2024Image Hover Effects – Elementor Addon: Stored Cross-Site ScriptingCVE-2024-4780 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Hover Effects – Elementor Addon
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Image Hover Effects – Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2024wp-cart-for-digital-products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6076 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-cart-for-digital-products
Fixed in
8.5.5
What to do
Update wp-cart-for-digital-products to 8.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 15, 2024wp-cart-for-digital-products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6074 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-cart-for-digital-products
Fixed in
8.5.5
What to do
Update wp-cart-for-digital-products to 8.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 15, 2024wp-cart-for-digital-products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6073 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-cart-for-digital-products
Fixed in
8.5.5
What to do
Update wp-cart-for-digital-products to 8.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 15, 2024wp-cart-for-digital-products: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6072 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
wp-cart-for-digital-products
Fixed in
8.5.5
What to do
Update wp-cart-for-digital-products to 8.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024If-So Dynamic Content Personalization: Does not sanitise and escape some of its settingsCVE-2024-6070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
If-So Dynamic Content Personalization
Fixed in
1.8.0.4
What to do
Update If-So Dynamic Content Personalization to 1.8.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-eMember: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5744 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
wp-eMember
Fixed in
10.6.7
What to do
Update wp-eMember to 10.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5715 · WordPress plugins & themes · reported by WPScanHigh 7.1
The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-eMember
Fixed in
10.6.7
What to do
Update wp-eMember to 10.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024If-So Dynamic Content Personalization: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5713 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
If-So Dynamic Content Personalization
Fixed in
1.8.0.4
What to do
Update If-So Dynamic Content Personalization to 1.8.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Tournamatch: Does not sanitise and escape some of its settingsCVE-2024-5644 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Tournamatch
Fixed in
4.6.1
What to do
Update Tournamatch to 4.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Ditty: Does not sanitise and escape some of its blocks' settingsCVE-2024-5575 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Ditty
Fixed in
3.1.43
What to do
Update Ditty to 3.1.43 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024WP QuickLaTeX: Does not sanitise and escape some of its settingsCVE-2024-5472 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP QuickLaTeX
Fixed in
3.8.7
What to do
Update WP QuickLaTeX to 3.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its settingsCVE-2024-5442 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.3
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5286 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5283 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5281 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-affiliate-platform
Fixed in
6.5.1
What to do
Update wp-affiliate-platform to 6.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024SULly: Does not sanitise and escape some of its settingsCVE-2024-5151 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
SULly
Fixed in
4.3.1
What to do
Update SULly to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5075 · WordPress plugins & themes · reported by WPScanMedium 5.9
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-eMember
Fixed in
10.6.6
What to do
Update wp-eMember to 10.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5074 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
wp-eMember
Fixed in
10.6.6
What to do
Update wp-eMember to 10.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024SULly: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5032 · WordPress plugins & themes · reported by WPScanMedium 4.7
The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
SULly
Fixed in
4.3.1
What to do
Update SULly to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024User Submitted Posts: Does not sanitise and escape some of its settingsCVE-2024-5002 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
User Submitted Posts
Fixed in
20240516
What to do
Update User Submitted Posts to 20240516 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Index WP MySQL For Speed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4977 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Index WP MySQL For Speed
Fixed in
1.4.18
What to do
Update Index WP MySQL For Speed to 1.4.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024EventON: Does not sanitise and escape some of its settingsCVE-2024-4752 · WordPress plugins & themes · reported by WPScanMedium 5.9
The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
EventON
Fixed in
2.2.15
What to do
Update EventON to 2.2.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Embed Peertube Playlist: Does not sanitise and escape some of its settingsCVE-2024-4602 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Embed Peertube Playlist
Fixed in
1.10
What to do
Update Embed Peertube Playlist to 1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024shortcodes-ultimate-pro: Does not properly escape some of its shortcodes' settingsCVE-2024-4217 · WordPress plugins & themes · reported by WPScanMedium 4.7
The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.
Product
shortcodes-ultimate-pro
Fixed in
7.1.5
What to do
Update shortcodes-ultimate-pro to 7.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-3964 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Product Enquiry for WooCommerce
Fixed in
3.1.8
What to do
Update Product Enquiry for WooCommerce to 3.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024OpenPGP Form Encryption for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3919 · WordPress plugins & themes · reported by WPScanMedium 4.6
The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenPGP Form Encryption for
Fixed in
1.5.1
What to do
Update OpenPGP Form Encryption for to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Hostel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3753 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Hostel
Fixed in
1.1.5.3
What to do
Update Hostel to 1.1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Seriously Simple Podcasting: Does not sanitise and escape some of its settingsCVE-2024-3751 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Seriously Simple Podcasting
Fixed in
3.3.0
What to do
Update Seriously Simple Podcasting to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Image Photo Gallery Final Tiles Grid: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-3710 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.0
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024socialdriver-framework: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-2870 · WordPress plugins & themes · reported by WPScanMedium 6.1
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
socialdriver-framework
Fixed in
2024.04.30
What to do
Update socialdriver-framework to 2024.04.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Stored Cross-Site ScriptingCVE-2024-5902 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in feedback form responses that will execute whenever a high-privileged user tries to view them.
Product
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2024GD Rating System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38709 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion.This issue affects GD Rating System: from n/a through 3.6.
Product
GD Rating System
Affected
up to 3.6
What to do
Affects up to 3.6. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-6495 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons for Elementor
Affected
up to 4.10.36
What to do
Affects up to 4.10.36. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2024WP Total Branding – Complete branding solution for: Stored Cross-Site ScriptingCVE-2024-6625 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Total Branding – Complete branding solution for
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Total Branding – Complete branding solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024PowerPress Podcasting plugin by Blubrry: Reflected Cross-Site ScriptingCVE-2024-6588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PowerPress Podcasting plugin by Blubrry
Affected
up to 11.9.10
What to do
Affects up to 11.9.10. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024Simple Video Directory: Does not sanitise and escape some of its settingsCVE-2024-5811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Video Directory
Fixed in
1.4.4
What to do
Update Simple Video Directory to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Inline Related Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Inline Related Posts
Fixed in
3.7.0
What to do
Update Inline Related Posts to 3.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024WP Secure Maintenance: Does not sanitise and escape some of its settingsCVE-2024-4753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Secure Maintenance
Fixed in
1.7
What to do
Update WP Secure Maintenance to 1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024socialdriver-framework: Does not sanitise and escape some of its settingsCVE-2024-2696 · WordPress plugins & themes · reported by WPScanMedium 4.8
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
socialdriver-framework
Fixed in
2024.04.30
What to do
Update socialdriver-framework to 2024.04.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Watu Quiz: Does not sanitise and escape some of its settingsCVE-2024-2640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Watu Quiz
Fixed in
3.4.1.2
What to do
Update Watu Quiz to 3.4.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Website Content in Page or Post: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2430 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Website Content in Page or Post
Fixed in
2024.04.09
What to do
Update Website Content in Page or Post to 2024.04.09 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Social Media Widget: Does not sanitise and escape some of its settingsCVE-2024-0974 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Social Media Widget
Fixed in
4.0.9
What to do
Update Social Media Widget to 4.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Image Optimizer, Resizer and CDN – Sirv: Unauthorized plugin settings modificationCVE-2024-6392 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024Feeds for YouTube (YouTube video, channel, and gallery plugin): Stored Cross-Site ScriptingCVE-2024-6256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Feeds for YouTube (YouTube video, channel, and gallery plugin)
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Feeds for YouTube (YouTube video, channel, and gallery plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6138 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Secure Copy Content Protection and Content Locking
Fixed in
4.0.9
What to do
Update Secure Copy Content Protection and Content Locking to 4.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its Quiz settingsCVE-2024-6025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.5
What to do
Update Quiz and Survey Master (QSM) to 9.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.