Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,328 results · page 9 of 27

Jan 31, 2025Zalomení: Does not sanitise and escape some of its settingsCVE-2024-12872 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Zalomení
Affected
up to 1.5
What to do
Affects up to 1.5. Update Zalomení to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2025WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features): Insecure Direct Object ReferenceCVE-2024-13694 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.
Product
WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features)
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Tracking Code Manager: Does not sanitise and escape some of its metabox settingsCVE-2024-10309 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Product
Tracking Code Manager
Fixed in
2.4.0
What to do
Update Tracking Code Manager to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 28, 2025Social Share Buttons for: Does not sanitise and escape some of its settingsCVE-2024-12807 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Social Share Buttons for
Affected
up to 2.7
What to do
Affects up to 2.7. Update Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 27, 2025Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-13116 · WordPress plugins & themes · reported by WPScanLow 3.8
The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Crelly Slider
Fixed in
1.4.7
What to do
Update Crelly Slider to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Jan 23, 2025XTRA Settings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23729 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings xtra-settings allows Reflected XSS.This issue affects XTRA Settings: from n/a through <= 2.1.8.
Product
XTRA Settings
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update XTRA Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 18, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet: Stored Cross-Site ScriptingCVE-2024-13391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet
Affected
up to 2.9.29
What to do
Affects up to 2.9.29. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025Marmoset Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revoxis Marmoset Viewer marmoset-viewer allows Stored XSS.This issue affects Marmoset Viewer: from n/a through <= 1.9.3.
Product
Marmoset Viewer
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Marmoset Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025SetMore Theme – Custom Post Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22748 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Setmore SetMore Theme – Custom Post Types service-provider-profile-cpt allows Stored XSS.This issue affects SetMore Theme – Custom Post Types: from n/a through <= 1.1.
Product
SetMore Theme – Custom Post Types
Affected
up to 1.1
What to do
Affects up to 1.1. Update SetMore Theme – Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Workflow settingsCVE-2024-12568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Email Subscribers by Icegram Express
Fixed in
5.7.45
What to do
Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Full record and what to do →NVD record wpscan.com
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its form settingsCVE-2024-12567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Email Subscribers by Icegram Express
Fixed in
5.7.45
What to do
Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Full record and what to do →NVD record wpscan.com
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of form settingsCVE-2024-12566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Email Subscribers by Icegram Express
Fixed in
5.7.45
What to do
Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Full record and what to do →NVD record wpscan.com
Jan 13, 2025Appointment Booking Calendar Plugin and Scheduling: Export settings functionality exports data to a public folderCVE-2024-12274 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).
Product
Appointment Booking Calendar Plugin and Scheduling
Fixed in
1.1.23
What to do
Update Appointment Booking Calendar Plugin and Scheduling to 1.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape some of its settingsCVE-2024-12717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Aklamator INfeed
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025Category Posts Widget: Does not sanitise and escape some of its settingsCVE-2024-9638 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Category Posts Widget
Fixed in
4.9.18
What to do
Update Category Posts Widget to 4.9.18 or newer.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025WordPress Auction: Does not sanitise and escape some of its settingsCVE-2024-8857 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks.
Product
WordPress Auction
Affected
up to 3.7
What to do
Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10562 · WordPress plugins & themes · reported by WPScanLow 2.7
The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.31
What to do
Update Form Maker by 10Web to 1.15.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2025Icegram Engage: Does not sanitise and escape some of its Campaign settingsCVE-2024-12302 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks
Product
Icegram Engage
Fixed in
3.1.32
What to do
Update Icegram Engage to 3.1.32 or newer.
Full record and what to do →NVD record wpscan.com
Jan 6, 2025Pods: Does not sanitise and escape some of its settingsCVE-2024-11849 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Pods
Fixed in
3.2.8.1
What to do
Update Pods to 3.2.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jan 2, 2025goodlayers-core: Does not sanitise and escape some of its settingsCVE-2024-11357 · WordPress plugins & themes · reported by WPScanMedium 5.9
The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
goodlayers-core
Fixed in
2.0.10
What to do
Update goodlayers-core to 2.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2024float block: Does not sanitise and escape some of its settingsCVE-2024-11645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
float block
Affected
up to 1.7
What to do
Affects up to 1.7. Update float block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-11223 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WPForms
Fixed in
1.9.2.3
What to do
Update WPForms to 1.9.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-8968 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress Button Plugin MaxButtons
Fixed in
9.8.1
What to do
Update WordPress Button Plugin MaxButtons to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 20, 2024Download Manager: Does not sanitise and escape some of its settingsCVE-2024-10706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Download Manager
Fixed in
3.3.03
What to do
Update Download Manager to 3.3.03 or newer.
Full record and what to do →NVD record wpscan.com
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-10555 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress Button Plugin MaxButtons
Fixed in
9.8.1
What to do
Update WordPress Button Plugin MaxButtons to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 16, 2024KH Easy User Settings: Incorrect Privilege AssignmentCVE-2024-54365 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy User Settings: from n/a through <= 1.0.0.
Product
KH Easy User Settings
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update KH Easy User Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Image Widget: Does not sanitise and escape some of its Image Widget settingsCVE-2024-10939 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Image Widget
Fixed in
4.4.11
What to do
Update Image Widget to 4.4.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2024LearnPress: Does not sanitise and escape some of its settingsCVE-2024-9881 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
LearnPress
Fixed in
4.2.7.2
What to do
Update LearnPress to 4.2.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2024LuckyWP Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-9641 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
LuckyWP Table of Contents
Fixed in
2.1.7
What to do
Update LuckyWP Table of Contents to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2024Popup Builder: Does not sanitise and escape some of its settingsCVE-2024-9428 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Popup Builder
Fixed in
4.3.5
What to do
Update Popup Builder to 4.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2024Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-10568 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ajax Search Lite
Fixed in
4.12.4
What to do
Update Ajax Search Lite to 4.12.4 or newer.
Full record and what to do →NVD record wpscan.com
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Membership Plan settingsCVE-2024-10518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.15.15
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Full record and what to do →NVD record wpscan.com
Dec 12, 2024LearnPress: Does not sanitise and escape some of its settingsCVE-2024-10010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
LearnPress
Fixed in
4.2.7.2
What to do
Update LearnPress to 4.2.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Dec 9, 2024Fluent Forms: Does not sanitise and escape some of its settingsCVE-2024-9651 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Fluent Forms
Fixed in
5.2.1
What to do
Update Fluent Forms to 5.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 7, 2024Simple Side Tab: Does not sanitise and escape some of its settingsCVE-2024-11183 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Side Tab
Fixed in
2.2.0
What to do
Update Simple Side Tab to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Dec 6, 2024Sticky Social Icons: Does not sanitise and escape some of its settingsCVE-2024-10551 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sticky Social Icons
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 3, 2024WP Booking Calendar: Does not sanitise and escape some of its settingsCVE-2024-10893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Booking Calendar
Fixed in
10.6.5
What to do
Update WP Booking Calendar to 10.6.5 or newer.
Full record and what to do →NVD record wpscan.com
Dec 2, 2024What Would Seth Godin Do: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51900 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in James Hunt What Would Seth Godin Do what-would-seth-godin-do allows Stored XSS.This issue affects What Would Seth Godin Do: from n/a through <= 2.1.1.
Product
What Would Seth Godin Do
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update What Would Seth Godin Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 30, 2024Asset CleanUp: Page Speed Booster: Server-Side Request Forgery (SSRF)CVE-2024-53738 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.3.9.8.
Product
Asset CleanUp: Page Speed Booster
Affected
up to 1.3.9.8
What to do
Affects up to 1.3.9.8. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 29, 2024Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10704 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.31
What to do
Update Photo Gallery by 10Web to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo and Slider settingsCVE-2024-10896 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting
Product
Logo Slider
Fixed in
4.5.0
What to do
Update Logo Slider to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 28, 2024adBuddy+ (AdBlocker Detection) by NetfunkDesign: Does not sanitise and escape some of its settingsCVE-2024-10510 · WordPress plugins & themes · reported by WPScanMedium 4.8
The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
adBuddy+ (AdBlocker Detection) by NetfunkDesign
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update adBuddy+ (AdBlocker Detection) by NetfunkDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo SettingsCVE-2024-10473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
Product
Logo Slider
Fixed in
4.5.0
What to do
Update Logo Slider to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 26, 2024Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-10471 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Everest Forms
Fixed in
3.0.4.2
What to do
Update Everest Forms to 3.0.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 25, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-7056 · WordPress plugins & themes · reported by WPScanLow 3.5
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WPForms
Fixed in
1.9.1.6
What to do
Update WPForms to 1.9.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.5
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 25, 2024YaDisk Files: Does not sanitise and escape some of its settingsCVE-2024-10710 · WordPress plugins & themes · reported by WPScanLow 3.5
The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
YaDisk Files
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update YaDisk Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 22, 2024GEO my WP WordPress plugin before 4.5, gmw-premium-settings: Does not sufficiently validate files to be uploadedCVE-2024-9422 · WordPress plugins & themes · reported by WPScanMedium 6.6
The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
Product
GEO my WP WordPress plugin before 4.5, gmw-premium-settings
Fixed in
4.5
What to do
Update GEO my WP WordPress plugin before 4.5, gmw-premium-settings to 4.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 21, 2024Formidable Forms: Does not sanitise and escape some of its settingsCVE-2024-9768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Formidable Forms
Fixed in
6.14.1
What to do
Update Formidable Forms to 6.14.1 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.