Vulnerability database

41,601 results · page 469 of 833

• Dec 16, 2024Mollie for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55990 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind SQL Injection.This issue affects Mollie for Contact Form 7: from n/a through <= 5.0.0.

  Product

  Mollie for Contact Form 7

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update Mollie for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Simple Pay Lite Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55989 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager allows SQL Injection.This issue affects WP Simple Pay Lite Manager: from n/a through <= 1.4.

  Product

  WP Simple Pay Lite Manager

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WP Simple Pay Lite Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Navayan CSV Export: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55988 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.

  Product

  Navayan CSV Export

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Navayan CSV Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Advanced What should we write next about: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55987 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows SQL Injection.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.

  Product

  Advanced What should we write next about

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Service: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55986 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tiny13 Service service allows Blind SQL Injection.This issue affects Service: from n/a through <= 1.0.4.

  Product

  Service

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55982 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.

  Product

  Share Buttons – Social Media

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.

  Product

  Nabz Image Gallery

  Affected

  up to 1.00

  What to do

  Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55980 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.

  Product

  Wr Age Verification

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55979 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.

  Product

  Wr Age Verification

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Code Generator Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55978 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.

  Product

  Code Generator Pro

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Code Generator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024LaunchPage.app Importer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55977 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-importer allows SQL Injection.This issue affects LaunchPage.app Importer: from n/a through <= 1.1.

  Product

  LaunchPage.app Importer

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update LaunchPage.app Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Critical Site Intel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55976 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.

  Product

  Critical Site Intel

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Critical Site Intel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Mimoos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55974 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciones-packback allows SQL Injection.This issue affects Mimoos: from n/a through <= 1.2.

  Product

  Mimoos

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Mimoos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024TSB Occasion Editor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55973 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through <= 1.2.1.

  Product

  TSB Occasion Editor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update TSB Occasion Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024eTemplates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55972 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.

  Product

  eTemplates

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update eTemplates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Advanced Data Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54443 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.

  Product

  Advanced Data Table For Elementor

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Advanced Data Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Better WP Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54442 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better-wp-login-page allows Stored XSS.This issue affects Better WP Login Page: from n/a through <= 1.1.2.

  Product

  Better WP Login Page

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Better WP Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Utech World Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54441 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.

  Product

  Utech World Time

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Utech World Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP-Ban-User: Cross-Site Request Forgery (CSRF)CVE-2024-54440 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0.

  Product

  WP-Ban-User

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP-Ban-User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Amazon Product Price: Cross-Site Request Forgery (CSRF)CVE-2024-54439 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.

  Product

  Amazon Product Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Amazon Product Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Gaxx Keywords: Cross-Site Request Forgery (CSRF)CVE-2024-54438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through <= 0.2.

  Product

  Gaxx Keywords

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Gaxx Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024jCarousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54437 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in koolkatwebdesigns jCarousel jcarousel-for-wordpress allows Stored XSS.This issue affects jCarousel: from n/a through <= 1.0.

  Product

  jCarousel

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update jCarousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Jet Footer Code: Cross-Site Request Forgery (CSRF)CVE-2024-54436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a through <= 1.4.

  Product

  Jet Footer Code

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Jet Footer Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Onlywire Multi Autosubmitter: Cross-Site Request Forgery (CSRF)CVE-2024-54435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through <= 1.2.4.

  Product

  Onlywire Multi Autosubmitter

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Onlywire Multi Autosubmitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024phZoom: Cross-Site Request Forgery (CSRF)CVE-2024-54434 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.

  Product

  phZoom

  Affected

  up to 1.2.92

  What to do

  Affects up to 1.2.92. Update phZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Simple Booking Widget: Cross-Site Request Forgery (CSRF)CVE-2024-54433 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through <= 1.1.

  Product

  Simple Booking Widget

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple Booking Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Flipkart Importer: Cross-Site Request Forgery (CSRF)CVE-2024-54432 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik WP Flipkart Importer wp-flipkart-importer allows Stored XSS.This issue affects WP Flipkart Importer: from n/a through <= 1.4.

  Product

  WP Flipkart Importer

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WP Flipkart Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Admin Customization: Cross-Site Request Forgery (CSRF)CVE-2024-54431 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in phpdevp Admin Customization wpp-customization allows Stored XSS.This issue affects Admin Customization: from n/a through <= 2.2.

  Product

  Admin Customization

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Admin Customization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024EELV Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-54430 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.

  Product

  EELV Newsletter

  Affected

  up to 4.8.2

  What to do

  Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Aphorismus: Cross-Site Request Forgery (CSRF)CVE-2024-54429 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through <= 1.2.0.

  Product

  Aphorismus

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Aphorismus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Add image to Post: Cross-Site Request Forgery (CSRF)CVE-2024-54428 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Add image to Post add-image-to-post allows Stored XSS.This issue affects Add image to Post: from n/a through <= 0.6.

  Product

  Add image to Post

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Add image to Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Category of Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54427 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ljmacphee Category of Posts list-one-category-of-posts allows Stored XSS.This issue affects Category of Posts: from n/a through <= 1.0.

  Product

  Category of Posts

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Category of Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024LeaderBoard: Cross-Site Request Forgery (CSRF)CVE-2024-54426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through <= 1.2.4.

  Product

  LeaderBoard

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update LeaderBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024LionScripts: Site Maintenance & Noindex Nofollow: Cross-Site Request Forgery (CSRF)CVE-2024-54425 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.com LionScripts: Site Maintenance & Noindex Nofollow Plugin maintenance-and-noindex-nofollow allows Stored XSS.This issue affects LionScripts: Site Maintenance & Noindex Nofollow Plugin: from n/a through <= 2.1.

  Product

  LionScripts: Site Maintenance & Noindex Nofollow

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update LionScripts: Site Maintenance & Noindex Nofollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Like in Vk.com: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilya_compman Like in Vk.com like-on-vkontakte allows Stored XSS.This issue affects Like in Vk.com: from n/a through <= 0.5.2.

  Product

  Like in Vk.com

  Affected

  up to 0.5.2

  What to do

  Affects up to 0.5.2. Update Like in Vk.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Social Media Sharing: Cross-Site Request Forgery (CSRF)CVE-2024-54423 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jesse Overright Social Media Sharing social-media-sharing allows Stored XSS.This issue affects Social Media Sharing: from n/a through <= 1.1.

  Product

  Social Media Sharing

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Social Media Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Evernote Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54422 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tgw365 Evernote Sync evernote-sync allows Reflected XSS.This issue affects Evernote Sync: from n/a through <= 3.0.0.

  Product

  Evernote Sync

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Evernote Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Floating Video Player: Cross-Site Request Forgery (CSRF)CVE-2024-54421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sanjay_Negi Floating Video Player floating-player allows Stored XSS.This issue affects Floating Video Player: from n/a through <= 1.0.

  Product

  Floating Video Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Floating Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Metrika: Cross-Site Request Forgery (CSRF)CVE-2024-54420 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Novikov Metrika metrika allows Cross Site Request Forgery.This issue affects Metrika: from n/a through <= 1.2.

  Product

  Metrika

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Ui Slider Filter By Price: Cross-Site Request Forgery (CSRF)CVE-2024-54419 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Cross Site Request Forgery.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.

  Product

  Ui Slider Filter By Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024DTC Documents: Cross-Site Request Forgery (CSRF)CVE-2024-54418 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through <= 1.1.05.

  Product

  DTC Documents

  Affected

  up to 1.1.05

  What to do

  Affects up to 1.1.05. Update DTC Documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024PixProof: Missing AuthorizationCVE-2024-54417 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.

  Product

  PixProof

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update PixProof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Wp Login with Ajax: Cross-Site Request Forgery (CSRF)CVE-2024-54416 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Navdeep Wp Login with Ajax wp-login-with-ajax allows Stored XSS.This issue affects Wp Login with Ajax: from n/a through <= 0.6.

  Product

  Wp Login with Ajax

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Wp Login with Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP-HideThat: Cross-Site Request Forgery (CSRF)CVE-2024-54415 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cconoly WP-HideThat wp-hide-that allows Stored XSS.This issue affects WP-HideThat: from n/a through <= 1.2.

  Product

  WP-HideThat

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update WP-HideThat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Geoportail Shortcode: Cross-Site Request Forgery (CSRF)CVE-2024-54414 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in geoWP Geoportail Shortcode geoportail-shortcode allows Stored XSS.This issue affects Geoportail Shortcode: from n/a through <= 2.4.4.

  Product

  Geoportail Shortcode

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Geoportail Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Display Future Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54413 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through <= 0.2.3.

  Product

  Display Future Posts

  Affected

  up to 0.2.3

  What to do

  Affects up to 0.2.3. Update Display Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024ECT Product Carousel: Cross-Site Request Forgery (CSRF)CVE-2024-54412 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carousel: from n/a through <= 1.9.

  Product

  ECT Product Carousel

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update ECT Product Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Controller: Cross-Site Request Forgery (CSRF)CVE-2024-54411 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hosting.io WP Controller wp-management-controller allows Stored XSS.This issue affects WP Controller: from n/a through <= 3.2.0.

  Product

  WP Controller

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update WP Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024SOPA Blackout: Cross-Site Request Forgery (CSRF)CVE-2024-54410 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in eagerterrier SOPA Blackout sopa-blackout allows Stored XSS.This issue affects SOPA Blackout: from n/a through <= 1.4.

  Product

  SOPA Blackout

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SOPA Blackout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024XPD Reduce Image Filesize: Cross-Site Request Forgery (CSRF)CVE-2024-54409 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in fzmaster XPD Reduce Image Filesize xpd-reduce-image-filesize allows Stored XSS.This issue affects XPD Reduce Image Filesize: from n/a through <= 1.0.

  Product

  XPD Reduce Image Filesize

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update XPD Reduce Image Filesize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.