Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

34added in the last 30 days

563new WordPress flaws this week

392,577entries in the database

6,578 results · page 107 of 132

May 14, 2024Corona Virus (COVID-19) Banner & Live Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data allows Stored XSS.This issue affects Corona Virus (COVID-19) Banner & Live Data: from n/a through 1.8.0.2.
Product
Corona Virus (COVID-19) Banner & Live Data
Affected
up to 1.8.0.2
What to do
Affects up to 1.8.0.2. Update Corona Virus (COVID-19) Banner & Live Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024AWSOM News Announcement: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34428 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harknell AWSOM News Announcement allows Stored XSS.This issue affects AWSOM News Announcement: from n/a through 1.6.0.
Product
AWSOM News Announcement
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update AWSOM News Announcement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Brozzme Scroll Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34426 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue affects Brozzme Scroll Top: from n/a through 1.8.5.
Product
Brozzme Scroll Top
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Brozzme Scroll Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024QuickieBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34425 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Baylog QuickieBar allows Stored XSS.This issue affects QuickieBar: from n/a through 1.8.4.
Product
QuickieBar
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update QuickieBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Featured Content Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34424 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iePlexus Featured Content Gallery allows Stored XSS.This issue affects Featured Content Gallery: from n/a through 3.2.0.
Product
Featured Content Gallery
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Featured Content Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Forty Four – 404 Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34423 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpbits Forty Four – 404 Plugin for WordPress allows Stored XSS.This issue affects Forty Four – 404 Plugin for WordPress: from n/a through 1.4.
Product
Forty Four – 404 Plugin for
Affected
up to 1.4
What to do
Affects up to 1.4. Update Forty Four – 404 Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Viet Affiliate Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trinhtuantai Viet Affiliate Link allows Stored XSS.This issue affects Viet Affiliate Link: from n/a through 1.2.
Product
Viet Affiliate Link
Affected
up to 1.2
What to do
Affects up to 1.2. Update Viet Affiliate Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024BlogLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34421 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsurface BlogLentor allows Stored XSS.This issue affects BlogLentor: from n/a through 1.0.8.
Product
BlogLentor
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update BlogLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Comments Evolved for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34420 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in talspotim Comments Evolved for WordPress allows Stored XSS.This issue affects Comments Evolved for WordPress: from n/a through 1.6.3.
Product
Comments Evolved for
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Comments Evolved for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Configure Login Timeout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34419 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nathan Vonnahme Configure Login Timeout allows Stored XSS.This issue affects Configure Login Timeout: from n/a through 1.0.
Product
Configure Login Timeout
Affected
up to 1.0
What to do
Affects up to 1.0. Update Configure Login Timeout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WPCS ( WordPress Custom Search ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34418 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tech9logy Creators WPCS ( WordPress Custom Search ) allows Stored XSS.This issue affects WPCS ( WordPress Custom Search ): from n/a through 1.1.
Product
WPCS ( WordPress Custom Search )
Affected
up to 1.1
What to do
Affects up to 1.1. Update WPCS ( WordPress Custom Search ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Viet Nam Affiliate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34417 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toidicode.Com (thanhtaivtt) Viet Nam Affiliate allows Stored XSS.This issue affects Viet Nam Affiliate: from n/a through 1.0.0.
Product
Viet Nam Affiliate
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Viet Nam Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Thim Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34415 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit allows Stored XSS.This issue affects Thim Elementor Kit: from n/a through 1.1.8.
Product
Thim Elementor Kit
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Freesia Empire: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33955 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Freesia Empire allows Stored XSS.This issue affects Freesia Empire: from n/a through 1.4.1.
Product
Freesia Empire
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Freesia Empire to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Pliska: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Yonkov Pliska allows Stored XSS.This issue affects Pliska: from n/a through 0.3.5.
Product
Pliska
Affected
up to 0.3.5
What to do
Affects up to 0.3.5. Update Pliska to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Adventure Journal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt van Andel Adventure Journal allows Stored XSS.This issue affects Adventure Journal: from n/a through 1.7.2.
Product
Adventure Journal
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Adventure Journal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Unique: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Unique allows Stored XSS.This issue affects Unique: from n/a through 0.3.0.
Product
Unique
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update Unique to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Perfect Pullquotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam DeHaven Perfect Pullquotes allows Stored XSS.This issue affects Perfect Pullquotes: from n/a through 1.7.5.
Product
Perfect Pullquotes
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Perfect Pullquotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34561 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Stored XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.71.
Product
3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
Affected
up to 3.71
What to do
Affects up to 3.71. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024gee Search Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34560 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GOMO gee Search Plus allows Stored XSS.This issue affects gee Search Plus: from n/a through 1.4.4.
Product
gee Search Plus
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update gee Search Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024WOLF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34558 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF: from n/a through 1.0.8.2.
Product
WOLF
Affected
up to 1.0.8.2
What to do
Affects up to 1.0.8.2. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Stockholm Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This issue affects Stockholm Core: from n/a through 2.4.1.
Product
Stockholm Core
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Stockholm Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024WidgetKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.4.8.
Product
WidgetKit
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through 1.1.34.
Product
Magical Addons For Elementor
Affected
up to 1.1.34
What to do
Affects up to 1.1.34. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Sticky Social Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34546 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allows DOM-Based XSS.This issue affects Sticky Social Link: from n/a through <= 2.0.1.
Product
Sticky Social Link
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Sticky Social Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024raindrops: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34414 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nobita allows Stored XSS.This issue affects raindrops: from n/a through 1.600.
Product
raindrops
Affected
up to 1.600
What to do
Affects up to 1.600. Update raindrops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34570 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.3.
Product
Xpro Elementor Addons
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.9.
Product
Zotpress
Affected
up to 7.3.9
What to do
Affects up to 7.3.9. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024LetterPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34568 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1.
Product
LetterPress
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update LetterPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Content Blocks (Custom Post Widget): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34566 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Debug Info: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34565 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10.
Product
Debug Info
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Debug Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Counter Up: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34564 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue affects Counter Up: from n/a through 2.2.1.
Product
Counter Up
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Counter Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Gold Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34563 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoldAddons Gold Addons for Elementor allows Stored XSS.This issue affects Gold Addons for Elementor: from n/a through 1.2.9.
Product
Gold Addons for Elementor
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Gold Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Move Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34562 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.3.0.
Product
Move Addons for Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Fancy Elementor Flipbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fancy-elementor-flipbox allows Stored XSS.This issue affects Fancy Elementor Flipbox: from n/a through 2.4.2.
Product
Fancy Elementor Flipbox
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Fancy Elementor Flipbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Himalayas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.0.
Product
Himalayas
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Himalayas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Table Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34574 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpsoul Table Maker allows Stored XSS.This issue affects Table Maker: from n/a through 1.9.1.
Product
Table Maker
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Table Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Pootle Pagebuilder – WordPress Page builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder allows Stored XSS.This issue affects Pootle Pagebuilder – WordPress Page builder: from n/a through 5.7.1.
Product
Pootle Pagebuilder – WordPress Page builder
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Pootle Pagebuilder – WordPress Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34413 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10.
Product
SliceWP
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update SliceWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Post Grid Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8.
Product
Post Grid Master
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34381 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.10.
Product
PropertyHive
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Conversational Forms for ChatBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34380 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.2.0.
Product
Conversational Forms for ChatBot
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Edge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34376 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects Edge: from n/a through 2.0.9.
Product
Edge
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Edge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Sheets To WP Table Live Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34375 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a through 3.7.0.
Product
Sheets To WP Table Live Sync
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Sheets To WP Table Live Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34374 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through 5.8.0.
Product
ElementsReady Addons for Elementor
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34373 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.4.2.
Product
The Plus Addons for Elementor Page Builder Lite
Affected
up to 5.4.2
What to do
Affects up to 5.4.2. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Webpushr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34369 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected XSS.This issue affects Webpushr: from n/a through 4.35.0.
Product
Webpushr
Affected
up to 4.35.0
What to do
Affects up to 4.35.0. Update Webpushr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Download Alt Text AI: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34366 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This issue affects Download Alt Text AI: from n/a through 1.3.4.
Product
Download Alt Text AI
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Download Alt Text AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Giphypress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affects Giphypress: from n/a through 1.6.2.
Product
Giphypress
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Giphypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024GWP-Histats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karl Kiesinger GWP-Histats allows Stored XSS.This issue affects GWP-Histats: from n/a through 1.0.
Product
GWP-Histats
Affected
up to 1.0
What to do
Affects up to 1.0. Update GWP-Histats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.