Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

434new WordPress flaws this week

394,398entries in the database

16,032 results · page 220 of 321

Jul 26, 2024ParityPress – Parity Pricing with Discount Rules: Stored Cross-Site ScriptingCVE-2024-6661 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ParityPress – Parity Pricing with Discount Rules
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update ParityPress – Parity Pricing with Discount Rules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2024Master Currency WP: Stored Cross-Site ScriptingCVE-2024-6634 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to, and including, 1.1.61 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Currency WP
Affected
up to 1.1.61
What to do
Affects up to 1.1.61. Update Master Currency WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 24, 2024Royal Elementor Addons and Templates: Stored DOM-based Cross-Site ScriptingCVE-2024-5818 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions up to, and including, 1.3.980 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.980
What to do
Affects up to 1.3.980. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Stored Cross-Site ScriptingCVE-2024-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2024AMP for WP – Accelerated Mobile Pages: Stored Cross-Site ScriptingCVE-2024-6896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.0.96.1
What to do
Affects up to 1.0.96.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2024WP Booking Calendar: Stored Cross-Site ScriptingCVE-2024-6930 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Booking Calendar
Affected
up to 10.2.1
What to do
Affects up to 10.2.1. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2024All-in-One Video Gallery: Stored Cross-Site ScriptingCVE-2024-6629 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All-in-One Video Gallery
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2024LiteSpeed Cache: Cross-Site Request ForgeryCVE-2024-3246 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LiteSpeed Cache
Affected
up to 6.2.0.1
What to do
Affects up to 6.2.0.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 23, 2024Social Auto Poster: Stored Cross-Site ScriptingCVE-2024-6753 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 23, 2024Social Auto Poster: Stored Cross-Site ScriptingCVE-2024-6752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 23, 2024Social Auto Poster: Cross-Site Request ForgeryCVE-2024-6751 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 22, 2024Ninja Beaver Add-ons for Beaver Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ninja Team Ninja Beaver Add-ons for Beaver Builder allows Stored XSS.This issue affects Ninja Beaver Add-ons for Beaver Builder: from n/a through 2.4.5.
Product
Ninja Beaver Add-ons for Beaver Builder
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Ninja Beaver Add-ons for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Branda: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37239 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Branda branda-white-labeling.This issue affects Branda: from n/a through <= 3.4.17.
Product
Branda
Affected
up to 3.4.17
What to do
Affects up to 3.4.17. Update Branda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Blogmentor – Blog Layouts for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37229 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AuburnForest Blogmentor – Blog Layouts for Elementor allows Stored XSS.This issue affects Blogmentor – Blog Layouts for Elementor: from n/a through 1.5.
Product
Blogmentor – Blog Layouts for Elementor
Affected
up to 1.5
What to do
Affects up to 1.5. Update Blogmentor – Blog Layouts for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Restaurant Reservations: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37223 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 2.0.
Product
Restaurant Reservations
Affected
up to 2.0
What to do
Affects up to 2.0. Update Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Kimili Flash Embed: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37221 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Bester Kimili Flash Embed allows Stored XSS.This issue affects Kimili Flash Embed: from n/a through 2.5.3.
Product
Kimili Flash Embed
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Kimili Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Page Builder Sandwich – Front-End Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37219 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PBN Hosting SL Page Builder Sandwich – Front-End Page Builder allows Stored XSS.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
Product
Page Builder Sandwich – Front-End Page Builder
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Page Builder Sandwich – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Empty Cart Button for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37217 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ProWCPlugins Empty Cart Button for WooCommerce allows Stored XSS.This issue affects Empty Cart Button for WooCommerce: from n/a through 1.3.8.
Product
Empty Cart Button for WooCommerce
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Empty Cart Button for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Sketchfab Embed: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37216 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rami Yushuvaev Sketchfab Embed allows Stored XSS.This issue affects Sketchfab Embed: from n/a through 1.5.
Product
Sketchfab Embed
Affected
up to 1.5
What to do
Affects up to 1.5. Update Sketchfab Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Transition Slider – Responsive Image Slider and Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37215 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in creativeinteractivemedia Transition Slider – Responsive Image Slider and Gallery allows Stored XSS.This issue affects Transition Slider – Responsive Image Slider and Gallery: from n/a through 2.20.3.
Product
Transition Slider – Responsive Image Slider and Gallery
Affected
up to 2.20.3
What to do
Affects up to 2.20.3. Update Transition Slider – Responsive Image Slider and Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Ali2Woo Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37211 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
Product
Ali2Woo Lite
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update Ali2Woo Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Demo Awesome: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37206 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This issue affects Demo Awesome: from n/a through 1.0.1.
Product
Demo Awesome
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Enfold: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37199 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflected XSS.This issue affects Enfold: from n/a through 5.6.9.
Product
Enfold
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Accordions: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37122 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Biplob Adhikari Accordions allows Stored XSS.This issue affects Accordions: from n/a through 2.3.5.
Product
Accordions
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Shortcode Addons: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37121 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Shortcode Addons allows Stored XSS.This issue affects Shortcode Addons: from n/a through 3.2.5.
Product
Shortcode Addons
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Shortcode Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Tabs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37120 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Biplob Adhikari Tabs allows Stored XSS.This issue affects Tabs: from n/a through 4.0.6.
Product
Tabs
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Uncanny Automator Pro: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37117 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Automator Pro allows Reflected XSS.This issue affects Uncanny Automator Pro: from n/a through 5.3.
Product
Uncanny Automator Pro
Affected
up to 5.3
What to do
Affects up to 5.3. Update Uncanny Automator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Sinatra: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37116 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sinatrateam Sinatra allows Stored XSS.This issue affects Sinatra: from n/a through 1.3.
Product
Sinatra
Affected
up to 1.3
What to do
Affects up to 1.3. Update Sinatra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024My Favorites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37114 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows DOM-Based XSS.This issue affects My Favorites: from n/a through <= 1.4.3.
Product
My Favorites
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update My Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024WP Post Author: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37101 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AF themes WP Post Author allows Stored XSS.This issue affects WP Post Author: from n/a through 3.6.7.
Product
WP Post Author
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Elegant Themes Icons: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37100 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mayur Somani, threeroutes media Elegant Themes Icons allows Stored XSS.This issue affects Elegant Themes Icons: from n/a through 1.3.
Product
Elegant Themes Icons
Affected
up to 1.3
What to do
Affects up to 1.3. Update Elegant Themes Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Shortcodes by United: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37097 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UnitedThemes Shortcodes by United Themes allows Reflected XSS.This issue affects Shortcodes by United Themes: from n/a before 5.0.5.
Product
Shortcodes by United
Fixed in
5.0.5
What to do
Update Shortcodes by United to 5.0.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Elementor Pro: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This issue affects Elementor Pro: from n/a through 3.21.2.
Product
Elementor Pro
Affected
up to 3.21.2
What to do
Affects up to 3.21.2. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Elementor – Header, Footer & Blocks Template: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-33933 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force, Nikhil Chavan Elementor – Header, Footer & Blocks Template allows DOM-Based XSS.This issue affects Elementor – Header, Footer & Blocks Template: from n/a through 1.6.35.
Product
Elementor – Header, Footer & Blocks Template
Affected
up to 1.6.35
What to do
Affects up to 1.6.35. Update Elementor – Header, Footer & Blocks Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Html5 Audio Player: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37445 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.2.23.
Product
Html5 Audio Player
Affected
up to 2.2.23
What to do
Affects up to 2.2.23. Update Html5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Uncanny Toolkit Pro for LearnDash: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Reflected XSS.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.
Product
Uncanny Toolkit Pro for LearnDash
Fixed in
4.1.4.1
What to do
Update Uncanny Toolkit Pro for LearnDash to 4.1.4.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37434 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 3.31.
Product
Atarim
Affected
up to 3.31
What to do
Affects up to 3.31. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.9.
Product
Mailster
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Esteem: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37432 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Esteem allows Stored XSS.This issue affects Esteem: from n/a through 1.5.0.
Product
Esteem
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Esteem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Login with phone number: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.35.
Product
Login with phone number
Affected
up to 1.7.35
What to do
Affects up to 1.7.35. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024WidgetKit: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37428 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.5.0.
Product
WidgetKit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Progress Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through <= 0.9.2.
Product
Progress Planner
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37416 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002.
Product
WP Photo Album Plus
Affected
up to 8.8.00.002
What to do
Affects up to 8.8.00.002. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Depicter Slider: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37414 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.0.2.
Product
Depicter Slider
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024PowerPack Lite for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37409 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder.This issue affects PowerPack Lite for Beaver Builder: from n/a through <= 1.3.0.4.
Product
PowerPack Lite for Beaver Builder
Affected
up to 1.3.0.4
What to do
Affects up to 1.3.0.4. Update PowerPack Lite for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Cards for Beaver Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37278 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Cards for Beaver Builder.This issue affects Cards for Beaver Builder: from n/a through 1.1.4.
Product
Cards for Beaver Builder
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Cards for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024NextScripts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37275 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows DOM-Based XSS.This issue affects NextScripts: from n/a through <= 4.4.7.
Product
NextScripts
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update NextScripts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Print My Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37271 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.27.0.
Product
Print My Blog
Affected
up to 3.27.0
What to do
Affects up to 3.27.0. Update Print My Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Striking: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37267 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in kaptinlin Striking allows Reflected XSS.This issue affects Striking: from n/a through 2.3.4.
Product
Striking
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Striking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024IdeaPush: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Gibson IdeaPush allows Stored XSS.This issue affects IdeaPush: from n/a through 8.60.
Product
IdeaPush
Affected
up to 8.60
What to do
Affects up to 8.60. Update IdeaPush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.