Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,962 results · page 67 of 100

Sep 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Arbitrary file uploadsCVE-2024-8242 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Beauty: Stored Cross-Site ScriptingCVE-2024-5884 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beauty
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Beauty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Tweaker5: Stored Cross-Site ScriptingCVE-2024-5870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tweaker5
Affected
up to 1.2
What to do
Affects up to 1.2. Update Tweaker5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Neighborly: Stored Cross-Site ScriptingCVE-2024-5869 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Neighborly
Affected
up to 1.4
What to do
Affects up to 1.4. Update Neighborly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Delicate: Stored Cross-Site ScriptingCVE-2024-5867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Delicate
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Delicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Triton Lite: Stored Cross-Site ScriptingCVE-2024-5789 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Triton Lite
Affected
up to 1.3
What to do
Affects up to 1.3. Update Triton Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8742 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Betheme: Stored Cross-Site ScriptingCVE-2024-5567 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Betheme
Affected
up to 27.5.5
What to do
Affects up to 27.5.5. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.muffingroup.com themeforest.net
Sep 13, 2024Avada | Website Builder For WordPress & eCommerce: Stored Cross-Site ScriptingCVE-2024-5628 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up to, and including, 3.11.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in 3.11.9. Additional hardening for alternate attack vectors was added to version 3.11.10.
Product
Avada | Website Builder For WordPress & eCommerce
Affected
up to 3.11.9
Fixed in
3.11.9
What to do
Update Avada | Website Builder For WordPress & eCommerce to 3.11.9 or newer.
Full record and what to do →NVD record avada.com avada.com
Sep 11, 2024Elementor Website Builder – More than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-5416 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in Elementor Editor pages. This was partially patched in version 3.23.2.
Product
Elementor Website Builder – More than Just a Page Builder
Affected
up to 3.23.4
What to do
Affects up to 3.23.4. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Advanced WordPress Backgrounds: Stored Cross-Site ScriptingCVE-2024-8045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced WordPress Backgrounds
Affected
up to 1.12.3
What to do
Affects up to 1.12.3. Update Advanced WordPress Backgrounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-6282 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
Product
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Affected
up to 2.0.6.4
What to do
Affects up to 2.0.6.4. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Slider comparison image before and after: Stored Cross-Site ScriptingCVE-2024-8543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider comparison image before and after
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Slider comparison image before and after to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2024Nova Blocks by Pixelgrade: Stored Cross-Site ScriptingCVE-2024-8241 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nova Blocks by Pixelgrade
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Nova Blocks by Pixelgrade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 10, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Stored Cross-Site ScriptingCVE-2024-7655 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Affected
up to 6.4.5.0
What to do
Affects up to 6.4.5.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Stored Cross-Site ScriptingCVE-2024-7618 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Affected
up to 6.4.5.0
What to do
Affects up to 6.4.5.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2024Ninja Forms - File Uploads: Stored Cross-Site ScriptingCVE-2024-1596 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms - File Uploads
Affected
up to 3.3.16
What to do
Affects up to 3.3.16. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com ninjaforms.com
Sep 7, 2024Preloader Plus – WordPress Loading Screen: Stored Cross-Site ScriptingCVE-2024-6849 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Preloader Plus – WordPress Loading Screen
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Preloader Plus – WordPress Loading Screen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 6, 2024Enter Addons – Ultimate Template Builder for Elementor: Stored Cross-Site ScriptingCVE-2024-7611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enter Addons – Ultimate Template Builder for Elementor
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Enter Addons – Ultimate Template Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Advanced Sermons: Stored Cross-Site ScriptingCVE-2024-7599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Sermons
Affected
up to 3.3
What to do
Affects up to 3.3. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024WP AdCenter – Ad Manager & Adsense Ads: Stored Cross-Site ScriptingCVE-2024-8317 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribute in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP AdCenter – Ad Manager & Adsense Ads
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update WP AdCenter – Ad Manager & Adsense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024Cab fare calculator: Stored Cross-Site ScriptingCVE-2022-3556 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Cab fare calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vehicle title setting in versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Cab fare calculator
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Cab fare calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 5, 2024Dynamic Featured Image: Stored Cross-Site ScriptingCVE-2024-6929 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dynamic Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘dfiFeatured’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dynamic Featured Image
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Dynamic Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024RD Station: Stored Cross-Site ScriptingCVE-2024-6894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping of post metaboxes added by the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RD Station
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update RD Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024Share This Image: Stored Cross-Site ScriptingCVE-2024-8363 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all versions up to, and including, 2.02 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Share This Image
Affected
up to 2.02
What to do
Affects up to 2.02. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024Attributes for Blocks: Stored Cross-Site ScriptingCVE-2024-8318 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Attributes for Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributesForBlocks’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Attributes for Blocks
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Attributes for Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2024Share This Image: Stored Cross-Site ScriptingCVE-2024-8108 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Share This Image
Affected
up to 2.01
What to do
Affects up to 2.01. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2024WPZOOM Portfolio Lite – Filterable Portfolio: Stored Cross-Site ScriptingCVE-2024-8276 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPZOOM Portfolio Lite – Filterable Portfolio
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update WPZOOM Portfolio Lite – Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-7122 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.13.6
What to do
Affects up to 1.13.6. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2024HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics: Stored Cross-Site ScriptingCVE-2024-5879 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
Affected
up to 11.1.22
What to do
Affects up to 11.1.22. Update HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2024Betheme: Stored Cross-Site ScriptingCVE-2024-3998 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Betheme
Affected
up to 27.5.6
What to do
Affects up to 27.5.6. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 30, 2024Enfold - Responsive Multi-Purpose: Stored Cross-Site ScriptingCVE-2024-5061 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enfold - Responsive Multi-Purpose
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Enfold - Responsive Multi-Purpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 30, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-4401 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' parameters in all versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.13.5
What to do
Affects up to 1.13.5. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024FunnelKit Funnel Builder Pro: Stored Cross-Site ScriptingCVE-2024-1056 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FunnelKit Funnel Builder Pro
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update FunnelKit Funnel Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record myaccount.funnelkit.com wordfence.com
Aug 29, 2024Premium Portfolio Features for Phlox: Stored Cross-Site ScriptingCVE-2024-1384 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_recent_portfolios_grid' shortcode in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Portfolio Features for Phlox
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Premium Portfolio Features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024Beaver Builder – WordPress Page Builder: Stored Cross-Site ScriptingCVE-2024-7895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.8.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.8.3.5
What to do
Affects up to 2.8.3.5. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024Front End Users: Stored Cross-Site ScriptingCVE-2024-7606 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Front End Users
Affected
up to 3.2.28
What to do
Affects up to 3.2.28. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024WP To Do: Stored Cross-Site ScriptingCVE-2024-3944 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP To Do
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP To Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vuCVE-2024-8030 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_wishlist cookie in versions up to , and including, 2.0.3. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code.
Fixed in
2.0.4
What to do
Update the plugin to 2.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 27, 2024140+ Widgets | Xpro Addons For Elementor – FREE: Stored Cross-Site ScriptingCVE-2024-7791 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parameter within the Post Grid widget in all versions up to, and including, 1.4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.4.3
What to do
Affects up to 1.4.4.3. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid: Stored Cross-Site ScriptingCVE-2024-8046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Ninja Tables – Easiest Data Table Builder: Stored Cross-Site ScriptingCVE-2024-7304 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Ninja Tables – Easiest Data Table Builder
Affected
up to 5.0.12
What to do
Affects up to 5.0.12. Update Ninja Tables – Easiest Data Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Jeg Elementor Kit: Stored Cross-Site ScriptingCVE-2024-6804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Jeg Elementor Kit
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2024Backup and Restore: Cross-Site Request Forgery (CSRF)CVE-2024-43269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1.50.
Product
Backup and Restore
Affected
up to 1.50
What to do
Affects up to 1.50. Update Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Store Locator Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.
Product
Store Locator Plus
Affected
up to 2311.17.01
What to do
Affects up to 2311.17.01. Update Store Locator Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024MyBookTable Bookstore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43255 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue affects MyBookTable Bookstore: from n/a through <= 3.3.9.
Product
MyBookTable Bookstore
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2024RT Easy Builder – Advanced addons for Elementor: Stored Cross-Site ScriptingCVE-2024-2254 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RT Easy Builder – Advanced addons for Elementor
Affected
up to 2.3
What to do
Affects up to 2.3. Update RT Easy Builder – Advanced addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2024Custom Permalinks: Stored Cross-Site ScriptingCVE-2023-0926 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled.
Product
Custom Permalinks
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Custom Permalinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 23, 2024Piotnet Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-5502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical Timeline widgets in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Piotnet Addons For Elementor
Affected
up to 2.4.30
What to do
Affects up to 2.4.30. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.