Vulnerability database

5,853 results · page 78 of 118

• Dec 6, 2024Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53802 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through <= 2.0.14.

  Product

  Futurio Extra

  Affected

  up to 2.0.14

  What to do

  Affects up to 2.0.14. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53801 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.2.1.

  Product

  Bold Page Builder

  Affected

  up to 5.2.1

  What to do

  Affects up to 5.2.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53797 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.4.3.

  Product

  Beaver Builder

  Affected

  up to 2.8.4.3

  What to do

  Affects up to 2.8.4.3. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53796 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows DOM-Based XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.2.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Arkhe Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53794 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows Stored XSS.This issue affects Arkhe Blocks: from n/a through <= 2.27.0.

  Product

  Arkhe Blocks

  Affected

  up to 2.27.0

  What to do

  Affects up to 2.27.0. Update Arkhe Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024RingCentral Communications: Cross-Site Request Forgery (CSRF)CVE-2024-53770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in pbmacintyre RingCentral Communications rccp-free allows Stored XSS.This issue affects RingCentral Communications: from n/a through <= 1.7.0.

  Product

  RingCentral Communications

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update RingCentral Communications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024ArCa Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through <= 1.3.1.

  Product

  ArCa Payment Gateway

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update ArCa Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Simple Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53741 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup simple-popup-plugin allows DOM-Based XSS.This issue affects Simple Popup: from n/a through <= 4.6.

  Product

  Simple Popup

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update Simple Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WooCommerce Ultimate Gift Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53740 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Reflected XSS.This issue affects WooCommerce Ultimate Gift Card: from n/a through < 2.9.1.

  Product

  WooCommerce Ultimate Gift Card

  What to do

  Update WooCommerce Ultimate Gift Card to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Advanced Event Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53721 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stachethemes Advanced Event Manager advanced-event-manager allows Stored XSS.This issue affects Advanced Event Manager: from n/a through <= 1.1.6.

  Product

  Advanced Event Manager

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Advanced Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Generic Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53709 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows DOM-Based XSS.This issue affects Generic Elements: from n/a through <= 1.2.5.

  Product

  Generic Elements

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Generic Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Tailored Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52503 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tailored Media Tailored Tools tailored-tools allows Stored XSS.This issue affects Tailored Tools: from n/a through <= 1.8.4.

  Product

  Tailored Tools

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024ImbaChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52502 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImbaSynergy ImbaChat imbachat-widget allows DOM-Based XSS.This issue affects ImbaChat: from n/a through <= 3.1.4.

  Product

  ImbaChat

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update ImbaChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Dynamic "To Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52494 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Varone, Tim Berneman Dynamic "To Top" allows Stored XSS.This issue affects Dynamic "To Top": from 3.5.2 through n/a.

  Product

  Dynamic "To Top

  What to do

  Update Dynamic "To Top to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Meteor Slides: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52493 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides meteor-slides allows Stored XSS.This issue affects Meteor Slides: from n/a through <= 1.5.7.

  Product

  Meteor Slides

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update Meteor Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Image horizontal reel scroll slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52492 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Image horizontal reel scroll slideshow image-horizontal-reel-scroll-slideshow allows Stored XSS.This issue affects Image horizontal reel scroll slideshow: from n/a through <= 13.4.

  Product

  Image horizontal reel scroll slideshow

  Affected

  up to 13.4

  What to do

  Affects up to 13.4. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Sticky Social Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52491 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanil Shakya Sticky Social Icons sticky-social-icons allows Stored XSS.This issue affects Sticky Social Icons: from n/a through <= 1.2.1.

  Product

  Sticky Social Icons

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Add Chat App Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52489 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through <= 2.1.5.

  Product

  Add Chat App Button

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Add Chat App Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Ultimate Classified Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52487 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows Stored XSS.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.

  Product

  Ultimate Classified Listings

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Elementor Portfolio Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52486 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SolverWp Elementor Portfolio Builder portfolio-builder-elementor allows DOM-Based XSS.This issue affects Elementor Portfolio Builder: from n/a through <= 1.0.0.

  Product

  Elementor Portfolio Builder

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Elementor Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Wc Recently viewed products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deepintowp Wc Recently viewed products wc-recently-viewed-products allows Reflected XSS.This issue affects Wc Recently viewed products: from n/a through <= 1.0.1.

  Product

  Wc Recently viewed products

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Wc Recently viewed products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LeanPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52483 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Benic LeanPress leanpress allows Reflected XSS.This issue affects LeanPress: from n/a through <= 1.0.0.

  Product

  LeanPress

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update LeanPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Ortto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through <= 1.0.19.

  Product

  Ortto

  Affected

  up to 1.0.19

  What to do

  Affects up to 1.0.19. Update Ortto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Jobify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52478 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Stored XSS.This issue affects Jobify: from n/a through < 4.3.0.

  Product

  Jobify

  Fixed in

  4.2.4

  What to do

  Update Jobify to 4.2.4 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WooCommerce Price Alert: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52469 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhrubok Infotech Services Ltd. WooCommerce Price Alert price-alert-woocommerce allows Reflected XSS.This issue affects WooCommerce Price Alert: from n/a through <= 1.0.4.

  Product

  WooCommerce Price Alert

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update WooCommerce Price Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LeadBoxer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadBoxer LeadBoxer leadboxer allows Reflected XSS.This issue affects LeadBoxer: from n/a through <= 1.3.

  Product

  LeadBoxer

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update LeadBoxer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024AI Responsive Gallery Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Reflected XSS.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.

  Product

  AI Responsive Gallery Album

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Explara Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52466 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Events explara-events allows Reflected XSS.This issue affects Explara Events: from n/a through <= 0.1.3.

  Product

  Explara Events

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Explara Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LGPD Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52465 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. LGPD Framework lgpd-framework allows Reflected XSS.This issue affects LGPD Framework: from n/a through <= 2.0.2.

  Product

  LGPD Framework

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update LGPD Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024amr shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52464 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anmari amr shortcodes amr-shortcodes allows Reflected XSS.This issue affects amr shortcodes: from n/a through <= 1.7.

  Product

  amr shortcodes

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update amr shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Post By Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52463 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Westwood Post By Email post-by-email allows Reflected XSS.This issue affects Post By Email: from n/a through <= 1.0.4b.

  Product

  Post By Email

  Affected

  up to 1.0.4b

  What to do

  Affects up to 1.0.4b. Update Post By Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WP e-Commerce Style Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52462 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.

  Product

  WP e-Commerce Style Email

  Affected

  up to 0.6.2

  What to do

  Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Infinite Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kinsta Infinite Slider infinite-slider allows Reflected XSS.This issue affects Infinite Slider: from n/a through <= 2.0.1.

  Product

  Infinite Slider

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Infinite Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024AtaraPay WooCommerce Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52460 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atarapay AtaraPay WooCommerce Payment Gateway atarapay-woocommerce allows Reflected XSS.This issue affects AtaraPay WooCommerce Payment Gateway: from n/a through <= 2.0.13.

  Product

  AtaraPay WooCommerce Payment Gateway

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update AtaraPay WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Chameleoni Jobs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52459 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chameleoni Chameleoni Jobs chameleon-jobs allows Reflected XSS.This issue affects Chameleoni Jobs: from n/a through <= 2.5.4.

  Product

  Chameleoni Jobs

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update Chameleoni Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.complugins.svn.wordpress.org

• Dec 2, 2024TM Islamic Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52458 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaymund TM Islamic Helper tm-islamic-helper allows Reflected XSS.This issue affects TM Islamic Helper: from n/a through <= 1.0.1.

  Product

  TM Islamic Helper

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update TM Islamic Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Youneeq Recommendations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52457 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in youneeq Youneeq Recommendations youneeq-panel allows Reflected XSS.This issue affects Youneeq Recommendations: from n/a through <= 3.0.7.

  Product

  Youneeq Recommendations

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Youneeq Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Awesome Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52456 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoets Awesome Studio awesome-studio allows Reflected XSS.This issue affects Awesome Studio: from n/a through <= 2.4.4.

  Product

  Awesome Studio

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Awesome Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024GoQSmile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQSmile goqsmile allows Reflected XSS.This issue affects GoQSmile: from n/a through <= 1.0.1.

  Product

  GoQSmile

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update GoQSmile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024GoQMieruca: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52454 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQMieruca goqmieruca allows Reflected XSS.This issue affects GoQMieruca: from n/a through <= 1.0.3.

  Product

  GoQMieruca

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update GoQMieruca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Library Bookshelves: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52453 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Reflected XSS.This issue affects Library Bookshelves: from n/a through <= 5.8.

  Product

  Library Bookshelves

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Open edX LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52452 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eduNEXT Open edX LMS allows Reflected XSS.This issue affects Open edX LMS: from n/a through 2.6.1.

  Product

  Open edX LMS

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update Open edX LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024What Would Seth Godin Do: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51900 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in James Hunt What Would Seth Godin Do what-would-seth-godin-do allows Stored XSS.This issue affects What Would Seth Godin Do: from n/a through <= 2.1.1.

  Product

  What Would Seth Godin Do

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update What Would Seth Godin Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Stripe Donation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53752 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berg Informatik Stripe Donation bin-stripe-donation allows Stored XSS.This issue affects Stripe Donation: from n/a through <= 1.2.5.

  Product

  Stripe Donation

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Stripe Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Post Carousel Slider for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53749 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Stored XSS.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.5.0.

  Product

  Post Carousel Slider for Elementor

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Post Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024WP Mermaid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53748 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP Mermaid wp-mermaid allows Stored XSS.This issue affects WP Mermaid: from n/a through <= 1.0.2.

  Product

  WP Mermaid

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Mermaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Video Player for WPBakery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53747 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nutttaro Video Player for WPBakery video-player-for-wpbakery allows Stored XSS.This issue affects Video Player for WPBakery: from n/a through <= 1.0.1.

  Product

  Video Player for WPBakery

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Video Player for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Elementor Button Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53746 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs Elementor Button Plus fd-elementor-button-plus allows Stored XSS.This issue affects Elementor Button Plus: from n/a through <= 1.3.9.

  Product

  Elementor Button Plus

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Elementor Button Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024소셜 공유 버튼 By 코스모스팜: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53745 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 코스모스팜 – Cosmosfarm 소셜 공유 버튼 By 코스모스팜 cosmosfarm-share-buttons allows Stored XSS.This issue affects 소셜 공유 버튼 By 코스모스팜: from n/a through <= 1.9.

  Product

  소셜 공유 버튼 By 코스모스팜

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update 소셜 공유 버튼 By 코스모스팜 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Elementor Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53744 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SkyBootstrap Elementor Image Gallery Plugin skyboot-portfolio-gallery allows Stored XSS.This issue affects Elementor Image Gallery Plugin: from n/a through <= 1.0.5.

  Product

  Elementor Image Gallery

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Elementor Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.