Updated 59 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

9,092 results · page 104 of 182

Dec 14, 2024WooCommerce Cart Count Shortcode: Stored Cross-Site ScriptingCVE-2024-12517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WooCommerce Cart Count Shortcode
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WooCommerce Cart Count Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024My IDX Home Search: Stored Cross-Site ScriptingCVE-2024-12502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My IDX Home Search
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update My IDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Smart PopUp Blaster: Stored Cross-Site ScriptingCVE-2024-12458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart PopUp Blaster
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart PopUp Blaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024Posts and Products Views for WooCommerce: Stored Cross-Site ScriptingCVE-2024-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Posts and Products Views for WooCommerce
Affected
up to 2.1
What to do
Affects up to 2.1. Update Posts and Products Views for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More: Stored Cross-Site ScriptingCVE-2024-12411 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024The Permalinker: Stored Cross-Site ScriptingCVE-2024-11894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Permalinker
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update The Permalinker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024My IDX Home Search: Stored Cross-Site ScriptingCVE-2024-11889 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-search' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My IDX Home Search
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update My IDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024IDer Login for: Stored Cross-Site ScriptingCVE-2024-11888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IDer Login for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ider_login_button' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects version 2.1, but was also patched in version 2.1 - a new version was not released with the patch.
Product
IDer Login for
Affected
up to 2.1
What to do
Affects up to 2.1. Update IDer Login for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Wp photo text slider 50: Stored Cross-Site ScriptingCVE-2024-11884 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up to, and including, 8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wp photo text slider 50
Affected
up to 8.1
What to do
Affects up to 8.1. Update Wp photo text slider 50 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024Connatix Video Embed: Stored Cross-Site ScriptingCVE-2024-11883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnx_script_code' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Connatix Video Embed
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Connatix Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Cricket Live Score: Stored Cross-Site ScriptingCVE-2024-11877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cricket_score' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cricket Live Score
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Cricket Live Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site: Stored Cross-Site ScriptingCVE-2024-11876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kredeum_opensky' shortcode in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024glomex oEmbed: Stored Cross-Site ScriptingCVE-2024-11873 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glomex_integration' shortcode in all versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
glomex oEmbed
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update glomex oEmbed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Buk for: Stored Cross-Site ScriptingCVE-2024-11869 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Buk for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buk' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Buk for
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Buk for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Companion Portfolio – Responsive Portfolio: Stored Cross-Site ScriptingCVE-2024-11867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio' shortcode in all versions up to, and including, 2.4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Companion Portfolio – Responsive Portfolio
Affected
up to 2.4.0.1
What to do
Affects up to 2.4.0.1. Update Companion Portfolio – Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Tabs Maker: Stored Cross-Site ScriptingCVE-2024-11865 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on tab descriptions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tabs Maker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Tabs Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 14, 2024Koalendar – Events & Appointments Booking Calendar: Stored Cross-Site ScriptingCVE-2024-11855 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Koalendar – Events & Appointments Booking Calendar
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Koalendar – Events & Appointments Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Post Carousel & Slider: Stored Cross-Site ScriptingCVE-2024-11770 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Carousel & Slider
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Plezi: Stored Cross-Site ScriptingCVE-2024-11763 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Plezi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'plezi' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Plezi
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Plezi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Bukza: Stored Cross-Site ScriptingCVE-2024-11759 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bukza
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Bukza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024IMS Countdown: Stored Cross-Site ScriptingCVE-2024-11755 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
IMS Countdown
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update IMS Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024TCBD Popover: Stored Cross-Site ScriptingCVE-2024-11751 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TCBD Popover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd-popover-image ' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TCBD Popover
Affected
up to 1.2
What to do
Affects up to 1.2. Update TCBD Popover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Visualmodo Elements: Stored Cross-Site ScriptingCVE-2024-11095 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Visualmodo Elements
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Visualmodo Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 13, 2024Hello Event Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54338 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christer_f Hello Event Widgets For Elementor hello-event-widgets-for-elementor allows DOM-Based XSS.This issue affects Hello Event Widgets For Elementor: from n/a through <= 1.0.2.
Product
Hello Event Widgets For Elementor
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Hello Event Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024ICDSoft Reseller Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icdsoft ICDSoft Reseller Store icdsoft-reseller-store allows Reflected XSS.This issue affects ICDSoft Reseller Store: from n/a through <= 2.4.5.
Product
ICDSoft Reseller Store
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ICDSoft Reseller Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Kundgenerator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kundgenerator Kundgenerator kundgenerator allows Reflected XSS.This issue affects Kundgenerator: from n/a through <= 1.0.6.
Product
Kundgenerator
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Kundgenerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Web Stories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54317 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This issue affects Web Stories: from n/a through <= 1.37.0.
Product
Web Stories
Affected
up to 1.37.0
What to do
Affects up to 1.37.0. Update Web Stories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows DOM-Based XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.8.
Product
Restaurant & Cafe Addon for Elementor
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Events Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.2.
Product
Events Addon for Elementor
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54314 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.6.0.
Product
Primary Addon for Elementor
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024LDD Directory Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54288 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LDD Web Design LDD Directory Lite ldd-directory-lite allows Reflected XSS.This issue affects LDD Directory Lite: from n/a through <= 3.3.
Product
LDD Directory Lite
Affected
up to 3.3
What to do
Affects up to 3.3. Update LDD Directory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024News Ticker for Elementor: Missing AuthorizationCVE-2024-54278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.
Product
News Ticker for Elementor
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update News Ticker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54265 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.6.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Shortcodes Blocks Creator Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/a through <= 2.2.0.
Product
Shortcodes Blocks Creator Ultimate
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Shortcodes Blocks Creator Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
Product
DELUCKS SEO
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni WooCommerce Bulk Product Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.
Product
Ni WooCommerce Bulk Product Editor
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Ni WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Directory Kit: Missing AuthorizationCVE-2023-41875 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.
Product
WP Directory Kit
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Cost Calculator Builder: Missing AuthorizationCVE-2023-40011 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Cost Calculator Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator Builder: from n/a through 3.1.42.
Product
Cost Calculator Builder
Affected
up to 3.1.42
What to do
Affects up to 3.1.42. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Booster Elementor Addons: Missing AuthorizationCVE-2023-38480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Certain Dev Booster Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster Elementor Addons: from n/a through 1.4.9.
Product
Booster Elementor Addons
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Booster Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024QR code MeCard/vCard generator: Missing AuthorizationCVE-2023-38477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0.
Product
QR code MeCard/vCard generator
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update QR code MeCard/vCard generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024DirectoryPress: Missing AuthorizationCVE-2023-37967 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.
Product
DirectoryPress
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024LiquidPoll – Advanced Polls for Creators and Brands: Missing AuthorizationCVE-2023-36531 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68.
Product
LiquidPoll – Advanced Polls for Creators and Brands
Affected
up to 3.3.68
What to do
Affects up to 3.3.68. Update LiquidPoll – Advanced Polls for Creators and Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024CHP Ads Block Detector: Missing AuthorizationCVE-2023-36509 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Suresh Chand CHP Ads Block Detector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CHP Ads Block Detector: from n/a through 3.9.5.
Product
CHP Ads Block Detector
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update CHP Ads Block Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Directorist: Missing AuthorizationCVE-2023-35052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4.
Product
Directorist
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Dynamic Visibility for Elementor: Missing AuthorizationCVE-2023-35046 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5.
Product
Dynamic Visibility for Elementor
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Dynamic Visibility for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Out of the Block: OpenStreetMap: Stored Cross-Site ScriptingCVE-2024-11827 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ootb_query shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Out of the Block: OpenStreetMap
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update Out of the Block: OpenStreetMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024Property Hive Stamp Duty Calculator: Stored Cross-Site ScriptingCVE-2024-12465 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Property Hive Stamp Duty Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stamp_duty_calculator_scotland' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Property Hive Stamp Duty Calculator
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update Property Hive Stamp Duty Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024The Simple Link Directory: Arbitrary shortcode executionCVE-2024-12417 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Simple Link Directory
Affected
up to 8.4.5
What to do
Affects up to 8.4.5. Update The Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024Themify Store Locator: Cross-Site Request ForgeryCVE-2024-12414 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the setting_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Themify Store Locator
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Themify Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Stored Cross-Site ScriptingCVE-2024-12042 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.16.4
What to do
Affects up to 4.16.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.