Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 46 of 112
May 15, 2025DL Verification: Does not sanitise and escape some of its settingsCVE-2024-6798 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025DL Robots.txt: Does not sanitise and escape some of its settingsCVE-2024-6797 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Robots.txt
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Robots.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Offload Videos: Does not have CSRF check in placeCVE-2024-6719 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
- Product
- Offload Videos
- Fixed in
- 1.0.1
- What to do
- Update Offload Videos to 1.0.1 or newer.
May 15, 2025PVN Auth Popup: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PVN Auth Popup: Does not sanitise and escape some of its settingsCVE-2024-6713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025MapFig Studio: Does not have CSRF check in some placesCVE-2024-6712 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- MapFig Studio
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update MapFig Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Event Tickets with Ticket Scanner: Does not sanitise and escape some parametersCVE-2024-6711 · WordPress plugins & themes · reported by WPScanLow 3.5
The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.3.8
- What to do
- Update Event Tickets with Ticket Scanner to 2.3.8 or newer.
May 15, 2025User Profile Builder: Does not sanitise and escape some parameters before outputting its content on the admin areaCVE-2024-6708 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
- Product
- User Profile Builder
- Fixed in
- 3.12.2
- What to do
- Update User Profile Builder to 3.12.2 or newer.
May 15, 2025wccp-pro: Does not sanitise and escape some of its settingsCVE-2024-6693 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- wccp-pro
- Fixed in
- 15.3
- What to do
- Update wccp-pro to 15.3 or newer.
May 15, 2025ProfilePro: Does not sanitise and escape some parameters and lacks proper access controlsCVE-2024-6668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks
- Product
- ProfilePro
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ProfilePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6667 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin.
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.5
- What to do
- Update KBucket: Your Curated Content in to 4.1.5 or newer.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape some of its settingsCVE-2024-6665 · WordPress plugins & themes · reported by WPScanMedium 4.8
The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.6
- What to do
- Update KBucket: Your Curated Content in to 4.1.6 or newer.
May 15, 2025CTT Expresso para WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-6478 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CTT Expresso para WooCommerce
- Fixed in
- 3.2.13
- What to do
- Update CTT Expresso para WooCommerce to 3.2.13 or newer.
May 15, 2025DL Yandex Metrika: Does not sanitise and escape some of its settingsCVE-2024-6462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DL Yandex Metrika
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Yandex Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Tracking Code Manager: Does not sanitise and escape some of its settingsCVE-2024-6335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tracking Code Manager
- Fixed in
- 2.3.0
- What to do
- Update Tracking Code Manager to 2.3.0 or newer.
May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Push Notification for Post and BuddyPress
- Fixed in
- 1.9.4
- What to do
- Update Push Notification for Post and BuddyPress to 1.9.4 or newer.
May 15, 2025If-So Dynamic Content Personalization: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5440 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.3
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.3 or newer.
May 15, 2025CM Tooltip Glossary: Does not sanitise and escape some of its settingsCVE-2024-5026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CM Tooltip Glossary
- Fixed in
- 4.3.4
- What to do
- Update CM Tooltip Glossary to 4.3.4 or newer.
May 15, 2025EventPrime: Does not properly validate permissionsCVE-2024-4665 · WordPress plugins & themes · reported by WPScanMedium 6.4
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
- Product
- EventPrime
- Fixed in
- 3.5.0
- What to do
- Update EventPrime to 3.5.0 or newer.
May 15, 2025Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-4091 · WordPress plugins & themes · reported by WPScanLow 3.5
The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.15
- What to do
- Update Responsive Gallery Grid to 2.3.15 or newer.
May 15, 2025Advanced Cron Manager: Does not sanitise and escape some of its settingsCVE-2024-4004 · WordPress plugins & themes · reported by WPScanLow 3.5
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Cron Manager
- Fixed in
- 2.5.7
- What to do
- Update Advanced Cron Manager to 2.5.7 or newer.
May 15, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-4002 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.6.9
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.6.9 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-3996 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Post Show
- Fixed in
- 2.4.28
- What to do
- Update Smart Post Show to 2.4.28 or newer.
May 15, 2025Genesis Blocks: Does not properly escape attributes provided to some of its custom blocksCVE-2024-3901 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
- Product
- Genesis Blocks
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Genesis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Save as Image Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2024-3062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as Image Plugin by Pdfcrowd
- Fixed in
- 3.2.2
- What to do
- Update Save as Image Plugin by Pdfcrowd to 3.2.2 or newer.
May 15, 2025Easy Property Listings: Does not sanitise and escape some of its settingsCVE-2024-2869 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
May 15, 2025Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-2643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.6.8
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.6.8 or newer.
May 15, 2025Ultimate Noindex Nofollow Tool II: Does not sanitise and escape some of its settingsCVE-2024-1663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Noindex Nofollow Tool II
- Fixed in
- 1.3.6
- What to do
- Update Ultimate Noindex Nofollow Tool II to 1.3.6 or newer.
May 15, 2025S3Player: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13865 · WordPress plugins & themes · reported by WPScanMedium 6.1
The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- S3Player
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update S3Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Badgearoo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13828 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025360 Product Rotation: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13823 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- 360 Product Rotation
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update 360 Product Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13730 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.2.1
- What to do
- Update Podlove Podcast Publisher to 4.2.1 or newer.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13729 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.1.24
- What to do
- Update Podlove Podcast Publisher to 4.1.24 or newer.
May 15, 2025MemberSpace: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13727 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- MemberSpace
- Fixed in
- 2.1.14
- What to do
- Update MemberSpace to 2.1.14 or newer.
May 15, 2025GDPR Framework By Data443: Does not sanitise and escape some of its settingsCVE-2024-13621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Framework By Data443
- Fixed in
- 2.2.0
- What to do
- Update GDPR Framework By Data443 to 2.2.0 or newer.
May 15, 2025LifterLMS: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- LifterLMS
- Fixed in
- 8.0.1
- What to do
- Update LifterLMS to 8.0.1 or newer.
May 15, 2025VikBooking Hotel Booking Engine & PMS: Does not sanitise and escape some of its settingsCVE-2024-13616 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.7.2
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.7.2 or newer.
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13486 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-13384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.24
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.24 or newer.
May 15, 2025HD Quiz: Does not sanitise and escape some of its settingsCVE-2024-13383 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- HD Quiz
- Fixed in
- 2.0.0
- What to do
- Update HD Quiz to 2.0.0 or newer.
May 15, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13382 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.64
- What to do
- Update Calculated Fields Form to 5.2.64 or newer.
May 15, 2025Ditty: Does not sanitise and escape some of its settingsCVE-2024-13357 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ditty
- Fixed in
- 3.1.52
- What to do
- Update Ditty to 3.1.52 or newer.
May 15, 2025AWeber: Does not sanitise and escape some of its settingsCVE-2024-13313 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AWeber
- Affected
- up to 7.3.20
- What to do
- Affects up to 7.3.20. Update AWeber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13128 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.5.1
- What to do
- Update LearnPress to 4.2.7.5.1 or newer.
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13127 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.5.1
- What to do
- Update LearnPress to 4.2.7.5.1 or newer.
May 15, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13053 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.33
- What to do
- Update Form Maker by 10Web to 1.15.33 or newer.
May 15, 2025Top Comments: Does not sanitise and escape some of its settingsCVE-2024-12874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Top Comments
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Top Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Custom Field Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Field Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Field Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Does not sanitise and escape some of its settingsCVE-2024-12808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Fixed in
- 1.13.4
- What to do
- Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.