Vulnerability database

5,859 results · page 90 of 118

• Sep 15, 2024Fluida: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44054 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issue affects Fluida: from n/a through 1.8.8.

  Product

  Fluida

  Affected

  up to 1.8.8

  What to do

  Affects up to 1.8.8. Update Fluida to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Opor Ayam: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44053 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This issue affects Opor Ayam: from n/a through 1.8.

  Product

  Opor Ayam

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Opor Ayam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Flipping Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45460 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manu225 Flipping Cards flipping-cards allows Stored XSS.This issue affects Flipping Cards: from n/a through <= 1.30.

  Product

  Flipping Cards

  Affected

  up to 1.30

  What to do

  Affects up to 1.30. Update Flipping Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Product Slider for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45459 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Reflected XSS.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.50.

  Product

  Product Slider for WooCommerce

  Affected

  up to 1.13.50

  What to do

  Affects up to 1.13.50. Update Product Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45458 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.

  Product

  Spiffy Calendar

  Affected

  up to 4.9.13

  What to do

  Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45457 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.

  Product

  Spiffy Calendar

  Affected

  up to 4.9.13

  What to do

  Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45456 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.

  Product

  WP Meta SEO

  Affected

  up to 4.5.13

  What to do

  Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45455 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.

  Product

  WP Meta SEO

  Affected

  up to 4.5.13

  What to do

  Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Happyforms: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.

  Product

  Happyforms

  Affected

  up to 1.26.0

  What to do

  Affects up to 1.26.0. Update Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Custom Field Template: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44062 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.

  Product

  Custom Field Template

  Affected

  up to 2.6.5

  What to do

  Affects up to 2.6.5. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Filmix: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44060 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1.

  Product

  Filmix

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Filmix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

  Product

  MM-Breaking News

  Affected

  up to 0.7.9

  What to do

  Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

  Product

  Music Request Manager

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2024Security, Antivirus, Firewall – S.A.F: IP Address SpoofingCVE-2022-4529 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.

  Product

  Security, Antivirus, Firewall – S.A.F

  Affected

  up to 2.3.5

  What to do

  Affects up to 2.3.5. Update Security, Antivirus, Firewall – S.A.F to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Aug 31, 2024WP Cerber Security: IP Protection bypassCVE-2022-4100 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.

  Product

  WP Cerber Security

  Affected

  up to 9.4

  What to do

  Affects up to 9.4. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Aug 29, 2024Magic Post Thumbnail: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43921 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9.

  Product

  Magic Post Thumbnail

  Affected

  up to 5.2.9

  What to do

  Affects up to 5.2.9. Update Magic Post Thumbnail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Gutenverse: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue affects Gutenverse: from n/a through 1.9.4.

  Product

  Gutenverse

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024DSGVO All in one for WP: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43964 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a through 4.5.

  Product

  DSGVO All in one for WP

  Affected

  up to 4.5

  What to do

  Affects up to 4.5. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024YellowPencil Visual CSS Style Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43963 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through 7.6.1.

  Product

  YellowPencil Visual CSS Style Editor

  Affected

  up to 7.6.1

  What to do

  Affects up to 7.6.1. Update YellowPencil Visual CSS Style Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024azurecurve Toggle Show/Hide: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43961 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stored XSS.This issue affects azurecurve Toggle Show/Hide: from n/a through 2.1.3.

  Product

  azurecurve Toggle Show/Hide

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update azurecurve Toggle Show/Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Web and WooCommerce Addons for WPBakery Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43960 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Page Builder Addons Web and WooCommerce Addons for WPBakery Builder allows Stored XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through 1.4.6.

  Product

  Web and WooCommerce Addons for WPBakery Builder

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Web and WooCommerce Addons for WPBakery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024IntoTheDark: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43958 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This issue affects IntoTheDark: from n/a through 1.0.5.

  Product

  IntoTheDark

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update IntoTheDark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Classic Addons – WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43953 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows Stored XSS.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.5.

  Product

  Classic Addons – WPBakery Page Builder

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Esotera: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43952 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Esotera allows Stored XSS.This issue affects Esotera: from n/a through 1.2.5.1.

  Product

  Esotera

  Affected

  up to 1.2.5.1

  What to do

  Affects up to 1.2.5.1. Update Esotera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Tempera: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43951 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Tempera allows Stored XSS.This issue affects Tempera: from n/a through 1.8.2.

  Product

  Tempera

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update Tempera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Brickscore: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43950 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nextbricks Brickscore allows Stored XSS.This issue affects Brickscore: from n/a through 1.4.2.5.

  Product

  Brickscore

  Affected

  up to 1.4.2.5

  What to do

  Affects up to 1.4.2.5. Update Brickscore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024GHActivity: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43949 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha.

  Product

  GHActivity

  Affected

  up to 2.0.0-alpha

  What to do

  Affects up to 2.0.0-alpha. Update GHActivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024WP Armour Extended: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43948 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.

  Product

  WP Armour Extended

  Affected

  up to 1.26

  What to do

  Affects up to 1.26. Update WP Armour Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024SKT Blocks – Gutenberg based Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43946 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Blocks – Gutenberg based Page Builder allows Stored XSS.This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 1.5.

  Product

  SKT Blocks – Gutenberg based Page Builder

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SKT Blocks – Gutenberg based Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024EmbedPress: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43936 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper EmbedPress allows Stored XSS.This issue affects EmbedPress: from n/a through 4.0.8.

  Product

  EmbedPress

  Affected

  up to 4.0.8

  What to do

  Affects up to 4.0.8. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Delicious Recipes – WordPress Recipe: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43935 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes – WordPress Recipe Plugin allows Stored XSS.This issue affects Delicious Recipes – WordPress Recipe Plugin: from n/a through 1.6.7.

  Product

  Delicious Recipes – WordPress Recipe

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Delicious Recipes – WordPress Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Collapsing Archives: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43934 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Robert Felty Collapsing Archives allows Stored XSS.This issue affects Collapsing Archives: from n/a through 3.0.5.

  Product

  Collapsing Archives

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Beaver Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43926 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Reflected XSS.This issue affects Beaver Builder: from n/a through 2.8.3.2.

  Product

  Beaver Builder

  Affected

  up to 2.8.3.2

  What to do

  Affects up to 2.8.3.2. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024MagePeople Team Taxi Booking Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43986 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: through 1.0.9.

  Product

  MagePeople Team Taxi Booking Manager for WooCommerce

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update MagePeople Team Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 26, 2024Zephyr Project Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43915 · WordPress plugins & themes · reported by PatchstackMedium 5.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.

  Product

  Zephyr Project Manager

  Fixed in

  3.3.103

  What to do

  Update Zephyr Project Manager to 3.3.103 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Aug 26, 2024MyBookTable Bookstore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43255 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue affects MyBookTable Bookstore: from n/a through <= 3.3.9.

  Product

  MyBookTable Bookstore

  Affected

  up to 3.3.9

  What to do

  Affects up to 3.3.9. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 26, 2024WP Testimonial Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43967 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stark Digital WP Testimonial Widget allows Stored XSS.This issue affects WP Testimonial Widget: from n/a through 3.1.

  Product

  WP Testimonial Widget

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 26, 2024Shield Security: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7313 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  Shield Security

  Fixed in

  20.0.6

  What to do

  Update Shield Security to 20.0.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 23, 2024Ditty: Re-introduced a previously fixed security issue (https://wpscanCVE-2024-6715 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39

  Product

  Ditty

  Fixed in

  3.1.46

  What to do

  Update Ditty to 3.1.46 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2024RegistrationMagic: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43317 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Metagauss User Registration Team RegistrationMagic allows Cross-Site Scripting (XSS).This issue affects RegistrationMagic: from n/a through 6.0.1.0.

  Product

  RegistrationMagic

  Affected

  up to 6.0.1.0

  What to do

  Affects up to 6.0.1.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Bold Timeline Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43294 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BoldThemes Bold Timeline Lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through 1.2.0.

  Product

  Bold Timeline Lite

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Envo's Elementor Templates & Widgets for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43292 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through 1.4.16.

  Product

  Envo's Elementor Templates & Widgets for WooCommerce

  Affected

  up to 1.4.16

  What to do

  Affects up to 1.4.16. Update Envo's Elementor Templates & Widgets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Void Contact Form 7 Widget For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43291 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder allows Stored XSS.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.4.1.

  Product

  Void Contact Form 7 Widget For Elementor Page Builder

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Void Contact Form 7 Widget For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024WP Travel Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43284 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through 3.5.1.

  Product

  WP Travel Gutenberg Blocks

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update WP Travel Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Newsletters: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43279 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.8.

  Product

  Newsletters

  Affected

  up to 4.9.8

  What to do

  Affects up to 4.9.8. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Meta Field Block: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43278 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Phi Phan Meta Field Block allows Stored XSS.This issue affects Meta Field Block: from n/a through 1.2.13.

  Product

  Meta Field Block

  Affected

  up to 1.2.13

  What to do

  Affects up to 1.2.13. Update Meta Field Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Mega Addons For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43267 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Qamar Sheeraz, Nasir Ahmad, GenialSouls Mega Addons For Elementor allows Stored XSS.This issue affects Mega Addons For Elementor: from n/a through 1.9.

  Product

  Mega Addons For Elementor

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Mega Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Visual Composer Starter: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Visual Composer Visual Composer Starter allows Stored XSS.This issue affects Visual Composer Starter: from n/a through 3.3.

  Product

  Visual Composer Starter

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Visual Composer Starter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024Busiprof: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43262 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webriti Busiprof allows Stored XSS.This issue affects Busiprof: from n/a through 2.4.8.

  Product

  Busiprof

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Busiprof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2024WHMpress: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43246 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in creativeon WHMpress allows Reflected XSS.This issue affects WHMpress: from n/a through 6.2-revision-5.

  Product

  WHMpress

  Affected

  up to 6.2-revision-5

  What to do

  Affects up to 6.2-revision-5. Update WHMpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.