Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

395,110entries in the database

15,570 results · page 232 of 312

Apr 17, 2024GuCherry Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32531 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest themes GuCherry Blog allows Reflected XSS.This issue affects GuCherry Blog: from n/a through 1.1.8.
Product
GuCherry Blog
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update GuCherry Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32530 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5.
Product
Simple Testimonials Showcase
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Yoga Schedule Momoyoga: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Momoyoga Yoga Schedule Momoyoga allows Stored XSS.This issue affects Yoga Schedule Momoyoga: from n/a through 2.7.0.
Product
Yoga Schedule Momoyoga
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Yoga Schedule Momoyoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP Dynamic Keywords Injector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32528 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seerox WP Dynamic Keywords Injector allows Reflected XSS.This issue affects WP Dynamic Keywords Injector: from n/a through 2.3.18.
Product
WP Dynamic Keywords Injector
Affected
up to 2.3.18
What to do
Affects up to 2.3.18. Update WP Dynamic Keywords Injector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Jotform Online Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jotform Jotform Online Forms allows Stored XSS.This issue affects Jotform Online Forms: from n/a through 1.3.1.
Product
Jotform Online Forms
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Jotform Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Easy Textillate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32526 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flector Easy Textillate allows Stored XSS.This issue affects Easy Textillate: from n/a through 2.02.
Product
Easy Textillate
Affected
up to 2.02
What to do
Affects up to 2.02. Update Easy Textillate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP Cost Estimation & Payment Forms Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Loopus WP Cost Estimation & Payment Forms Builder allows Reflected XSS.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75.
Product
WP Cost Estimation & Payment Forms Builder
Affected
up to 10.1.75
What to do
Affects up to 10.1.75. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32508 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.
Product
DethemeKit For Elementor
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.0.6.
Product
ElementsKit Elementor addons Lite
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Elements Plus!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32457 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The CSSIgniter Team Elements Plus! allows Stored XSS.This issue affects Elements Plus!: from n/a through 2.16.3.
Product
Elements Plus!
Affected
up to 2.16.3
What to do
Affects up to 2.16.3. Update Elements Plus! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Envo Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32456 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra allows Stored XSS.This issue affects Envo Extra: from n/a through 1.8.11.
Product
Envo Extra
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Payment Forms for Paystack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32130 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paystack Payment Forms for Paystack allows Stored XSS.This issue affects Payment Forms for Paystack: from n/a through 3.4.1.
Product
Payment Forms for Paystack
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Tax Rate Upload: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32546 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.
Product
Tax Rate Upload
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Tax Rate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Canva – Design beautiful blog graphics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Canva Canva – Design beautiful blog graphics allows Reflected XSS.This issue affects Canva – Design beautiful blog graphics: from n/a through 1.2.4.
Product
Canva – Design beautiful blog graphics
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Canva – Design beautiful blog graphics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Netgsm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through 2.8.
Product
Netgsm
Affected
up to 2.8
What to do
Affects up to 2.8. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024MJ Update History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minoji MJ Update History allows Reflected XSS.This issue affects MJ Update History: from n/a through 1.0.4.
Product
MJ Update History
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update MJ Update History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Bulk Block Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32542 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1.
Product
Bulk Block Converter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Bulk Block Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP-Cufon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32541 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tobias Battenberg WP-Cufon allows Stored XSS.This issue affects WP-Cufon: from n/a through 1.6.10.
Product
WP-Cufon
Affected
up to 1.6.10
What to do
Affects up to 1.6.10. Update WP-Cufon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Fixed HTML Toolbar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32540 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Web357 Fixed HTML Toolbar allows Stored XSS.This issue affects Fixed HTML Toolbar: from n/a through 1.0.7.
Product
Fixed HTML Toolbar
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Fixed HTML Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP File Download Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This issue affects WP File Download Light: from n/a through 1.3.3.
Product
WP File Download Light
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WP File Download Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP TradingView: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trade Pips WP TradingView allows Stored XSS.This issue affects WP TradingView: from n/a through 1.7.
Product
WP TradingView
Affected
up to 1.7
What to do
Affects up to 1.7. Update WP TradingView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Access Category Password: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jojaba Access Category Password allows Reflected XSS.This issue affects Access Category Password: from n/a through 1.5.1.
Product
Access Category Password
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Access Category Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.23.
Product
Form Maker by 10Web
Affected
up to 1.15.23
What to do
Affects up to 1.15.23. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024LH Add Media From Url: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Shaw LH Add Media From Url allows Reflected XSS.This issue affects LH Add Media From Url: from n/a through 1.22.
Product
LH Add Media From Url
Affected
up to 1.22
What to do
Affects up to 1.22. Update LH Add Media From Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024What's New Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hideki Tanaka What's New Generator allows Stored XSS.This issue affects What's New Generator: from n/a through 2.0.2.
Product
What's New Generator
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update What's New Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Code Insert Manager (Q2W3 Inc Manager): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32547 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond Code Insert Manager (Q2W3 Inc Manager) allows Reflected XSS.This issue affects Code Insert Manager (Q2W3 Inc Manager): from n/a through 2.5.3.
Product
Code Insert Manager (Q2W3 Inc Manager)
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Code Insert Manager (Q2W3 Inc Manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
Fixed in
3.4.0
What to do
Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024Social Media Share Buttons & Social Sharing Icons: Does not sanitise and escape some of its settingsCVE-2024-2118 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
2.8.9
What to do
Update Social Media Share Buttons & Social Sharing Icons to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-1219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Easy Social Feed
Fixed in
6.5.6
What to do
Update Easy Social Feed to 6.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 16, 2024LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-40000 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.
Product
LiteSpeed Cache
Affected
up to 5.7
What to do
Affects up to 5.7. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Citadela Listing: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32086 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5.18.1.
Product
Citadela Listing
Affected
up to 5.18.1
What to do
Affects up to 5.18.1. Update Citadela Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024BA Book Everything: Stored Cross-Site ScriptingCVE-2024-3672 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32576 is likely a duplicate of this issue.
Product
BA Book Everything
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 16, 2024archive-tainacan-collection: Reflected Cross-Site ScriptingCVE-2024-3867 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in version 2.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
archive-tainacan-collection
What to do
Update archive-tainacan-collection to the newest version.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Apr 16, 2024Shortcodes and extra features for Phlox: Stored Cross-Site ScriptingCVE-2024-1357 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as thumb_mode and date_type. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.15.7
What to do
Affects up to 2.15.7. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 16, 2024Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.2.
Product
Exclusive Addons Elementor
Affected
up to 2.6.9.2
What to do
Affects up to 2.6.9.2. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024WordPress Hosting Benchmark tool: Cross-Site Request Forgery (CSRF)CVE-2024-31922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Anton Aleksandrov WordPress Hosting Benchmark tool.This issue affects WordPress Hosting Benchmark tool: from n/a through 1.3.6.
Product
WordPress Hosting Benchmark tool
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WordPress Hosting Benchmark tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Email Marketing for WooCommerce by Omnisend: Cross-Site Request Forgery (CSRF)CVE-2024-32101 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend omnisend-connect.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through <= 1.14.3.
Product
Email Marketing for WooCommerce by Omnisend
Affected
up to 1.14.3
What to do
Affects up to 1.14.3. Update Email Marketing for WooCommerce by Omnisend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Citadela Listing: Cross-Site Request Forgery (CSRF)CVE-2024-32085 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a before 5.20.0.
Product
Citadela Listing
Fixed in
5.20.0
What to do
Update Citadela Listing to 5.20.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024POEditor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32453 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POEditor allows Stored XSS.This issue affects POEditor: from n/a through 0.9.8.
Product
POEditor
Affected
up to 0.9.8
What to do
Affects up to 0.9.8. Update POEditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Remove Footer Credit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue affects Remove Footer Credit: from n/a through 1.0.13.
Product
Remove Footer Credit
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Remove Footer Credit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024MWW Disclaimer Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32428 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moss Web Works MWW Disclaimer Buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through 3.0.2.
Product
MWW Disclaimer Buttons
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update MWW Disclaimer Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Jobs for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32149 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Jobs for WordPress allows Reflected XSS.This issue affects Jobs for WordPress: from n/a through 2.7.5.
Product
Jobs for
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Jobs for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Easy Contact Form Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32147 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through 1.1.23.
Product
Easy Contact Form Lite
Affected
up to 1.1.23
What to do
Affects up to 1.1.23. Update Easy Contact Form Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024WP Google Analytics Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32145 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS.This issue affects WP Google Analytics Events: from n/a through 2.8.0.
Product
WP Google Analytics Events
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update WP Google Analytics Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Libsyn Publisher Hub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32140 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in libsyn Libsyn Publisher Hub libsyn-podcasting.This issue affects Libsyn Publisher Hub: from n/a through <= 1.4.4.
Product
Libsyn Publisher Hub
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Short URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32138 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Short URL allows Reflected XSS.This issue affects Short URL: from n/a through 1.6.8.
Product
Short URL
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024EZ Form Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32133 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Schuppenies EZ Form Calculator allows Reflected XSS.This issue affects EZ Form Calculator: from n/a through 2.14.0.3.
Product
EZ Form Calculator
Affected
up to 2.14.0.3
What to do
Affects up to 2.14.0.3. Update EZ Form Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2024.2.
Product
Advanced iFrame
Affected
up to 2024.2
What to do
Affects up to 2024.2. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Social Share, Social Login and Social Comments: Does not sanitise and escape some of its settingsCVE-2024-2836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.64
What to do
Update Social Share, Social Login and Social Comments to 7.13.64 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Responsive Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1846 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs
Fixed in
4.0.7
What to do
Update Responsive Tabs to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.