Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

979 results · page 10 of 20

Nov 23, 2024Checkout with Cash App on WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Checkout with Cash App on WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wp_http_referer' parameter in several files in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Checkout with Cash App on WooCommerce
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Checkout with Cash App on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024Chessgame Shizzle: Reflected Cross-Site ScriptingCVE-2024-11446 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chessgame Shizzle plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'cs_nonce' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chessgame Shizzle
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Chessgame Shizzle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024Custom CSS, JS & PHP: Reflected Cross-Site ScriptingCVE-2024-11330 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Custom CSS, JS & PHP
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Custom CSS, JS & PHP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: POST-Based Reflected Cross-Site ScriptingCVE-2024-11188 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Affected
up to 6.16.1.2
What to do
Affects up to 6.16.1.2. Update Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 23, 2024PDF Invoices & Packing Slips Generator for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11361 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Invoices & Packing Slips Generator for WooCommerce
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update PDF Invoices & Packing Slips Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024JobBoardWP – Job Board Listings and Submissions: Reflected Cross-Site ScriptingCVE-2024-10880 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
JobBoardWP – Job Board Listings and Submissions
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update JobBoardWP – Job Board Listings and Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024DeBounce Email Validator: Reflected Cross-Site ScriptingCVE-2024-11463 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DeBounce Email Validator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'from', 'to', and 'key' parameters in all versions up to, and including, 5.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24539 is a possible duplicate of this issue.
Product
DeBounce Email Validator
Affected
up to 5.6.5
What to do
Affects up to 5.6.5. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2024Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Reflected Cross-Site ScriptingCVE-2024-11362 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.112.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
Affected
up to 1.112.0
What to do
Affects up to 1.112.0. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024WordPress Brute Force Protection – Stop Brute Force Attacks: Reflected Cross-Site ScriptingCVE-2024-10869 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WordPress Brute Force Protection – Stop Brute Force Attacks
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update WordPress Brute Force Protection – Stop Brute Force Attacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024MailMunch – Grow your Email List: Reflected Cross-Site ScriptingCVE-2024-8735 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MailMunch – Grow your Email List
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update MailMunch – Grow your Email List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024Premium Packages – Sell Digital Products Securely: Reflected Cross-Site ScriptingCVE-2024-11225 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.9.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 5.9.3
What to do
Affects up to 5.9.3. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Branda – White Label & Branding, Custom Login Page Customizer: Reflected Cross-Site ScriptingCVE-2024-9371 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Branda – White Label & Branding, Custom Login Page Customizer
Affected
up to 3.4.19
What to do
Affects up to 3.4.19. Update Branda – White Label & Branding, Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Run Contests, Raffles, and Giveaways with ContestsWP: Reflected Cross-Site ScriptingCVE-2024-11456 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Run Contests, Raffles, and Giveaways with ContestsWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Run Contests, Raffles, and Giveaways with ContestsWP
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Run Contests, Raffles, and Giveaways with ContestsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Community by PeepSo – Download from PeepSo.com: Reflected Cross-Site ScriptingCVE-2024-11447 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Community by PeepSo – Download from PeepSo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filter’ parameter in all versions up to, and including, 7.0.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Community by PeepSo – Download from PeepSo.com
Affected
up to 7.0.3.0
What to do
Affects up to 7.0.3.0. Update Community by PeepSo – Download from PeepSo.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024salavat counter: Reflected Cross-Site ScriptingCVE-2024-11435 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The salavat counter Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
salavat counter
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update salavat counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Theater for: Reflected Cross-Site ScriptingCVE-2024-11371 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Theater for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.18.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Theater for
Affected
up to 0.18.6.2
What to do
Affects up to 0.18.6.2. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Subaccounts for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11370 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Subaccounts for WooCommerce
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Subaccounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes: Reflected Cross-Site ScriptingCVE-2024-11365 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Page Parts: Reflected Cross-Site ScriptingCVE-2024-11360 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Page Parts
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Page Parts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024WPAdverts – Classifieds: Reflected Cross-Site ScriptingCVE-2024-10890 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WPAdverts – Classifieds
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels: Reflected Cross-Site ScriptingCVE-2024-10792 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This was partially patched in 3.5.4 and fully patched in 3.5.5.
Product
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Announcement & Notification Banner – Bulletin: Reflected Cross-Site ScriptingCVE-2024-10682 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg and remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.11.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Announcement & Notification Banner – Bulletin
Affected
up to 3.11.7
What to do
Affects up to 3.11.7. Update Announcement & Notification Banner – Bulletin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024affiliate-toolkit: Reflected Cross-Site ScriptingCVE-2024-10675 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The affiliate-toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
affiliate-toolkit
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024ForumEngine: Reflected Cross-Site ScriptingCVE-2024-10623 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ForumEngine theme for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ForumEngine
Affected
up to 1.8
What to do
Affects up to 1.8. Update ForumEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record enginethemes.com wordfence.com
Nov 21, 2024Co-marquage service-public.fr: Reflected Cross-Site ScriptingCVE-2024-10522 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.5.76. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Co-marquage service-public.fr
Affected
up to 0.5.76
What to do
Affects up to 0.5.76. Update Co-marquage service-public.fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 20, 2024Booster for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9239 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Booster for WooCommerce
Affected
up to 7.2.3
What to do
Affects up to 7.2.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 20, 2024MailChimp Forms by MailMunch: Reflected Cross-Site ScriptingCVE-2024-8726 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MailChimp Forms by MailMunch
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2024404 Solution: Reflected Cross-Site ScriptingCVE-2024-11277 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
404 Solution
Affected
up to 2.35.19
What to do
Affects up to 2.35.19. Update 404 Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2024Restaurant Menu – Food Ordering System – Table Reservation: Reflected Cross-Site ScriptingCVE-2024-9653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Restaurant Menu – Food Ordering System – Table Reservation
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2024GD bbPress Attachments: Reflected Cross-Site ScriptingCVE-2024-11278 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
GD bbPress Attachments
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update GD bbPress Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2024HUSKY – Products Filter Professional for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11400 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6.3
What to do
Affects up to 1.3.6.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 19, 2024Bard: Reflected Cross-Site ScriptingCVE-2024-9830 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Bard
Affected
up to 2.216
What to do
Affects up to 2.216. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Nov 19, 2024Ashe: Reflected Cross-Site ScriptingCVE-2024-9777 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ashe
Affected
up to 2.243
What to do
Affects up to 2.243. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Nov 15, 2024Bounce Handler MailPoet 3: Reflected Cross-Site ScriptingCVE-2024-9938 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Bounce Handler MailPoet 3
Affected
up to 1.3.21
What to do
Affects up to 1.3.21. Update Bounce Handler MailPoet 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024BulkPress: Reflected Cross-Site ScriptingCVE-2024-9615 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BulkPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.3.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BulkPress
Affected
up to 0.3.5
What to do
Affects up to 0.3.5. Update BulkPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024PeproDev WooCommerce Receipt Uploader: Reflected Cross-Site ScriptingCVE-2024-8873 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24574 is likely a duplicate of this issue.
Product
PeproDev WooCommerce Receipt Uploader
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update PeproDev WooCommerce Receipt Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024SimpleForm Contact Form Submissions: Reflected Cross-Site ScriptingCVE-2024-10884 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SimpleForm Contact Form Submissions
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update SimpleForm Contact Form Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024SimpleForm – Contact form made simple: Reflected Cross-Site ScriptingCVE-2024-10883 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SimpleForm – Contact form made simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SimpleForm – Contact form made simple
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update SimpleForm – Contact form made simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024Gallery Manager: Reflected Cross-Site ScriptingCVE-2024-10875 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_Query_Arg without appropriate escaping on the URL in all versions up to, and including, 1.6.58. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Gallery Manager
Affected
up to 1.6.58
What to do
Affects up to 1.6.58. Update Gallery Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024Hide My WP Ghost – Security & Firewall: Reflected Cross-Site ScriptingCVE-2024-10825 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
Hide My WP Ghost – Security & Firewall
Affected
up to 5.3.01
What to do
Affects up to 5.3.01. Update Hide My WP Ghost – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Yotpo: Product & Photo Reviews for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_user_name' parameters in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Yotpo: Product & Photo Reviews for WooCommerce
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update Yotpo: Product & Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024LearnPress Export Import – WordPress extension for LearnPress: Reflected Cross-Site ScriptingCVE-2024-9609 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
LearnPress Export Import – WordPress extension for LearnPress
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update LearnPress Export Import – WordPress extension for LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 13, 2024AFI – The Easiest Integration: Reflected Cross-Site ScriptingCVE-2024-10877 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.92.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AFI – The Easiest Integration
Affected
up to 1.92.0
What to do
Affects up to 1.92.0. Update AFI – The Easiest Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Product Delivery Date for WooCommerce – Lite: Reflected Cross-Site ScriptingCVE-2024-10882 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Product Delivery Date for WooCommerce – Lite
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Kognetiks Chatbot for: Reflected Cross-Site ScriptingCVE-2024-10684 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2024Constant Contact Forms by MailMunch: Reflected Cross-Site ScriptingCVE-2024-9614 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Constant Contact Forms by MailMunch
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Constant Contact Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024AJAX Login and Registration modal popup + inline form: Reflected Cross-Site ScriptingCVE-2024-8874 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AJAX Login and Registration modal popup + inline form
Affected
up to 2.24
What to do
Affects up to 2.24. Update AJAX Login and Registration modal popup + inline form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Razorpay Payment Button: Reflected Cross-Site ScriptingCVE-2024-10851 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Razorpay Payment Button
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Razorpay Payment Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Razorpay Payment Button Elementor: Reflected Cross-Site ScriptingCVE-2024-10850 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Razorpay Payment Button Elementor
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Razorpay Payment Button Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件: Reflected Cross-Site ScriptingCVE-2024-10577 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to missing escaping on a URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update 胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.