Vulnerability database

5,700 results · page 68 of 114

• Dec 17, 2024WP All Import Pro: Server-Side Request ForgeryCVE-2024-9624 · WordPress plugins & themes · reported by WordfenceHigh 7.6

  The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.

  Product

  WP All Import Pro

  Affected

  up to 4.9.3

  What to do

  Affects up to 4.9.3. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordfence.comwpallimport.com

• Dec 16, 2024Stop Registration Spam: Cross-Site Request Forgery (CSRF)CVE-2024-56017 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23.

  Product

  Stop Registration Spam

  Affected

  up to 1.23

  What to do

  Affects up to 1.23. Update Stop Registration Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024EazyDocs: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54376 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Spider Themes EazyDocs eazydocs allows PHP Local File Inclusion.This issue affects EazyDocs: from n/a through <= 2.8.0.

  Product

  EazyDocs

  Affected

  up to 2.8.0

  What to do

  Affects up to 2.8.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Avada: Cross-Site Request Forgery (CSRF)CVE-2024-54357 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.

  Product

  Avada

  Affected

  up to 7.11.10

  What to do

  Affects up to 7.11.10. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Tidy Up: Cross-Site Request Forgery (CSRF)CVE-2024-56015 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3.

  Product

  Tidy Up

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Tidy Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Flash News / Post (Responsive): Cross-Site Request Forgery (CSRF)CVE-2024-56012 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.

  Product

  Flash News / Post (Responsive)

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Flash News / Post (Responsive) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Posti Shipping: Cross-Site Request Forgery (CSRF)CVE-2024-56005 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: from n/a through <= 3.10.3.

  Product

  Posti Shipping

  Affected

  up to 3.10.3

  What to do

  Affects up to 3.10.3. Update Posti Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP-Ban-User: Cross-Site Request Forgery (CSRF)CVE-2024-54440 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0.

  Product

  WP-Ban-User

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP-Ban-User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Amazon Product Price: Cross-Site Request Forgery (CSRF)CVE-2024-54439 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.

  Product

  Amazon Product Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Amazon Product Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Gaxx Keywords: Cross-Site Request Forgery (CSRF)CVE-2024-54438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through <= 0.2.

  Product

  Gaxx Keywords

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Gaxx Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Jet Footer Code: Cross-Site Request Forgery (CSRF)CVE-2024-54436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a through <= 1.4.

  Product

  Jet Footer Code

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Jet Footer Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Onlywire Multi Autosubmitter: Cross-Site Request Forgery (CSRF)CVE-2024-54435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through <= 1.2.4.

  Product

  Onlywire Multi Autosubmitter

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Onlywire Multi Autosubmitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024phZoom: Cross-Site Request Forgery (CSRF)CVE-2024-54434 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.

  Product

  phZoom

  Affected

  up to 1.2.92

  What to do

  Affects up to 1.2.92. Update phZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Simple Booking Widget: Cross-Site Request Forgery (CSRF)CVE-2024-54433 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through <= 1.1.

  Product

  Simple Booking Widget

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple Booking Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Flipkart Importer: Cross-Site Request Forgery (CSRF)CVE-2024-54432 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik WP Flipkart Importer wp-flipkart-importer allows Stored XSS.This issue affects WP Flipkart Importer: from n/a through <= 1.4.

  Product

  WP Flipkart Importer

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WP Flipkart Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Admin Customization: Cross-Site Request Forgery (CSRF)CVE-2024-54431 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in phpdevp Admin Customization wpp-customization allows Stored XSS.This issue affects Admin Customization: from n/a through <= 2.2.

  Product

  Admin Customization

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Admin Customization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024EELV Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-54430 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.

  Product

  EELV Newsletter

  Affected

  up to 4.8.2

  What to do

  Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Aphorismus: Cross-Site Request Forgery (CSRF)CVE-2024-54429 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through <= 1.2.0.

  Product

  Aphorismus

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Aphorismus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Add image to Post: Cross-Site Request Forgery (CSRF)CVE-2024-54428 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Add image to Post add-image-to-post allows Stored XSS.This issue affects Add image to Post: from n/a through <= 0.6.

  Product

  Add image to Post

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Add image to Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Category of Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54427 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ljmacphee Category of Posts list-one-category-of-posts allows Stored XSS.This issue affects Category of Posts: from n/a through <= 1.0.

  Product

  Category of Posts

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Category of Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024LeaderBoard: Cross-Site Request Forgery (CSRF)CVE-2024-54426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through <= 1.2.4.

  Product

  LeaderBoard

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update LeaderBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024LionScripts: Site Maintenance & Noindex Nofollow: Cross-Site Request Forgery (CSRF)CVE-2024-54425 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.com LionScripts: Site Maintenance & Noindex Nofollow Plugin maintenance-and-noindex-nofollow allows Stored XSS.This issue affects LionScripts: Site Maintenance & Noindex Nofollow Plugin: from n/a through <= 2.1.

  Product

  LionScripts: Site Maintenance & Noindex Nofollow

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update LionScripts: Site Maintenance & Noindex Nofollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Social Media Sharing: Cross-Site Request Forgery (CSRF)CVE-2024-54423 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jesse Overright Social Media Sharing social-media-sharing allows Stored XSS.This issue affects Social Media Sharing: from n/a through <= 1.1.

  Product

  Social Media Sharing

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Social Media Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Floating Video Player: Cross-Site Request Forgery (CSRF)CVE-2024-54421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sanjay_Negi Floating Video Player floating-player allows Stored XSS.This issue affects Floating Video Player: from n/a through <= 1.0.

  Product

  Floating Video Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Floating Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Metrika: Cross-Site Request Forgery (CSRF)CVE-2024-54420 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Novikov Metrika metrika allows Cross Site Request Forgery.This issue affects Metrika: from n/a through <= 1.2.

  Product

  Metrika

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Ui Slider Filter By Price: Cross-Site Request Forgery (CSRF)CVE-2024-54419 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Cross Site Request Forgery.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.

  Product

  Ui Slider Filter By Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024DTC Documents: Cross-Site Request Forgery (CSRF)CVE-2024-54418 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through <= 1.1.05.

  Product

  DTC Documents

  Affected

  up to 1.1.05

  What to do

  Affects up to 1.1.05. Update DTC Documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Wp Login with Ajax: Cross-Site Request Forgery (CSRF)CVE-2024-54416 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Navdeep Wp Login with Ajax wp-login-with-ajax allows Stored XSS.This issue affects Wp Login with Ajax: from n/a through <= 0.6.

  Product

  Wp Login with Ajax

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Wp Login with Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP-HideThat: Cross-Site Request Forgery (CSRF)CVE-2024-54415 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cconoly WP-HideThat wp-hide-that allows Stored XSS.This issue affects WP-HideThat: from n/a through <= 1.2.

  Product

  WP-HideThat

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update WP-HideThat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Geoportail Shortcode: Cross-Site Request Forgery (CSRF)CVE-2024-54414 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in geoWP Geoportail Shortcode geoportail-shortcode allows Stored XSS.This issue affects Geoportail Shortcode: from n/a through <= 2.4.4.

  Product

  Geoportail Shortcode

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Geoportail Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Display Future Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54413 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through <= 0.2.3.

  Product

  Display Future Posts

  Affected

  up to 0.2.3

  What to do

  Affects up to 0.2.3. Update Display Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024ECT Product Carousel: Cross-Site Request Forgery (CSRF)CVE-2024-54412 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carousel: from n/a through <= 1.9.

  Product

  ECT Product Carousel

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update ECT Product Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Controller: Cross-Site Request Forgery (CSRF)CVE-2024-54411 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hosting.io WP Controller wp-management-controller allows Stored XSS.This issue affects WP Controller: from n/a through <= 3.2.0.

  Product

  WP Controller

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update WP Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024SOPA Blackout: Cross-Site Request Forgery (CSRF)CVE-2024-54410 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in eagerterrier SOPA Blackout sopa-blackout allows Stored XSS.This issue affects SOPA Blackout: from n/a through <= 1.4.

  Product

  SOPA Blackout

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SOPA Blackout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024XPD Reduce Image Filesize: Cross-Site Request Forgery (CSRF)CVE-2024-54409 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in fzmaster XPD Reduce Image Filesize xpd-reduce-image-filesize allows Stored XSS.This issue affects XPD Reduce Image Filesize: from n/a through <= 1.0.

  Product

  XPD Reduce Image Filesize

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update XPD Reduce Image Filesize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Youtube Video Grid: Cross-Site Request Forgery (CSRF)CVE-2024-54408 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Video Grid: from n/a through <= 1.9.

  Product

  Youtube Video Grid

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Youtube Video Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024CK and SyntaxHighlighter: Cross-Site Request Forgery (CSRF)CVE-2024-54407 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a328496647 CK and SyntaxHighlighter ck-and-syntaxhighlighter allows Stored XSS.This issue affects CK and SyntaxHighlighter: from n/a through <= 3.4.2.

  Product

  CK and SyntaxHighlighter

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update CK and SyntaxHighlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024ECT Social Share: Cross-Site Request Forgery (CSRF)CVE-2024-54405 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Social Share ect-social-share allows Stored XSS.This issue affects ECT Social Share: from n/a through <= 1.3.

  Product

  ECT Social Share

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update ECT Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024MDC Comment Toolbar: Cross-Site Request Forgery (CSRF)CVE-2024-54404 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan MDC Comment Toolbar mdc-comment-toolbar allows Stored XSS.This issue affects MDC Comment Toolbar: from n/a through <= 1.1.

  Product

  MDC Comment Toolbar

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update MDC Comment Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Advanced Fancybox: Cross-Site Request Forgery (CSRF)CVE-2024-54401 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Advanced Fancybox advanced-fancybox allows Stored XSS.This issue affects Advanced Fancybox: from n/a through <= 1.1.1.

  Product

  Advanced Fancybox

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Advanced Fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024AppMaps: Cross-Site Request Forgery (CSRF)CVE-2024-54400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in meloniq AppMaps appmaps allows Stored XSS.This issue affects AppMaps: from n/a through <= 1.1.

  Product

  AppMaps

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update AppMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024CRUDLab Google Plus Button: Cross-Site Request Forgery (CSRF)CVE-2024-54399 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google Plus Button: from n/a through <= 1.0.2.

  Product

  CRUDLab Google Plus Button

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update CRUDLab Google Plus Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Flaming Forms: Cross-Site Request Forgery (CSRF)CVE-2024-54398 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through <= 1.0.1.

  Product

  Flaming Forms

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Go Animate: Cross-Site Request Forgery (CSRF)CVE-2024-54397 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in antonio.gocaj Go Animate goanimate allows Stored XSS.This issue affects Go Animate: from n/a through <= 1.0.

  Product

  Go Animate

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Go Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Bet sport Free: Cross-Site Request Forgery (CSRF)CVE-2024-54396 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in elmervillanueva Bet sport Free bet-sport-free allows Cross Site Request Forgery.This issue affects Bet sport Free: from n/a through <= 1.0.0.

  Product

  Bet sport Free

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Bet sport Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Mandrill WP: Cross-Site Request Forgery (CSRF)CVE-2024-54394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in khubbaib Mandrill WP email-form-under-post allows Stored XSS.This issue affects Mandrill WP: from n/a through <= 1.0.5.

  Product

  Mandrill WP

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Mandrill WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Fiddle: Cross-Site Request Forgery (CSRF)CVE-2024-54393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sheikh Heera WP Fiddle wp-fiddle allows Stored XSS.This issue affects WP Fiddle: from n/a through <= 1.0.

  Product

  WP Fiddle

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Fiddle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP微信机器人: Cross-Site Request Forgery (CSRF)CVE-2024-54392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in midoks WP微信机器人 wp-weixin-robot allows Stored XSS.This issue affects WP微信机器人: from n/a through <= 5.3.5.

  Product

  WP微信机器人

  Affected

  up to 5.3.5

  What to do

  Affects up to 5.3.5. Update WP微信机器人 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WordPress Filter: Cross-Site Request Forgery (CSRF)CVE-2024-54391 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mattwalters WordPress Filter wordpress-filter allows Stored XSS.This issue affects WordPress Filter: from n/a through <= 1.4.1.

  Product

  WordPress Filter

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update WordPress Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024addWeather: Cross-Site Request Forgery (CSRF)CVE-2024-54389 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Eduardo addWeather myweather allows Cross Site Request Forgery.This issue affects addWeather: from n/a through <= 2.5.1.

  Product

  addWeather

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update addWeather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.