Vulnerability database

9,098 results · page 111 of 182

• Nov 12, 2024BuddyPress Builder for Elementor – BuddyBuilder: Information ExposureCVE-2024-10778 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts crated by Elementor that they should not have access to.

  Product

  BuddyPress Builder for Elementor – BuddyBuilder

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update BuddyPress Builder for Elementor – BuddyBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 12, 2024WP-Strava: Stored Cross-Site ScriptingCVE-2024-10038 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  WP-Strava

  Affected

  up to 2.12.1

  What to do

  Affects up to 2.12.1. Update WP-Strava to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comwordfence.com

• Nov 12, 2024JetWidgets For Elementor: Stored Cross-Site ScriptingCVE-2024-10323 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  JetWidgets For Elementor

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update JetWidgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 12, 2024Slickstream: Engagement and Conversions: Stored Cross-Site ScriptingCVE-2024-10179 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Slickstream: Engagement and Conversions

  Affected

  up to 1.4.4

  What to do

  Affects up to 1.4.4. Update Slickstream: Engagement and Conversions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 12, 2024Admin and Site Enhancements (ASE): Stored Cross-Site ScriptingCVE-2024-10790 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. This feature must be enabled, and for specific roles in order to be exploitable.

  Product

  Admin and Site Enhancements (ASE)

  Affected

  up to 7.5.1

  What to do

  Affects up to 7.5.1. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 11, 2024Multiple Page Generator Plugin – MPG: Arbitrary file deletionCVE-2024-10672 · WordPress plugins & themes · reported by WordfenceLow 2.7

  The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upsert_project_source_block() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to delete limited files on the server.

  Product

  Multiple Page Generator Plugin – MPG

  Affected

  up to 4.0.2

  What to do

  Affects up to 4.0.2. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 11, 2024Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-10538 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image Comparison widget in all versions up to, and including, 3.12.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Happy Addons for Elementor

  Affected

  up to 3.12.5

  What to do

  Affects up to 3.12.5. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 11, 2024Web Stories Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52354 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cool Plugins Web Stories Widgets For Elementor shortcodes-for-amp-web-stories-and-elementor-widget allows Stored XSS.This issue affects Web Stories Widgets For Elementor: from n/a through <= 1.1.

  Product

  Web Stories Widgets For Elementor

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Web Stories Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 11, 2024Responsive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52358 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows DOM-Based XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.5.4.

  Product

  Responsive Addons for Elementor

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 11, 2024The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52356 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.0.

  Product

  The Pack Elementor addons

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 11, 2024The Novel Design Store Directory: Unrestricted Upload of File with Dangerous TypeCVE-2024-51788 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web Shell to a Web Server.This issue affects The Novel Design Store Directory: from n/a through <= 4.3.0.

  Product

  The Novel Design Store Directory

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update The Novel Design Store Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 11, 2024Extender All In One For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51575 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Abdullah Al Masum Extender All In One For Elementor extender-all-in-one-for-elementor allows Stored XSS.This issue affects Extender All In One For Elementor: from n/a through <= 1.0.3.

  Product

  Extender All In One For Elementor

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Extender All In One For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 11, 2024MasterBip para Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51571 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.

  Product

  MasterBip para Elementor

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update MasterBip para Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 10, 2024Marquee Elementor with Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51584 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anas2004 Marquee Elementor with Posts marquee-elementor allows DOM-Based XSS.This issue affects Marquee Elementor with Posts: from n/a through <= 1.2.0.

  Product

  Marquee Elementor with Posts

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Marquee Elementor with Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 10, 2024Kento Ads Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51583 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento Ads Rotator kento-ads-rotator allows Stored XSS.This issue affects Kento Ads Rotator: from n/a through <= 1.3.

  Product

  Kento Ads Rotator

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Kento Ads Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 10, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51581 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows Stored XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.6.

  Product

  Restaurant & Cafe Addon for Elementor

  Affected

  up to 1.5.6

  What to do

  Affects up to 1.5.6. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 10, 2024Clever Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51580 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zootemplate Clever Addons for Elementor cafe-lite allows Stored XSS.This issue affects Clever Addons for Elementor: from n/a through <= 2.2.1.

  Product

  Clever Addons for Elementor

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Clever Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024ThemeShark Templates & Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51597 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeshark ThemeShark Templates & Widgets for Elementor themeshark-elementor allows Stored XSS.This issue affects ThemeShark Templates & Widgets for Elementor: from n/a through <= 1.1.7.

  Product

  ThemeShark Templates & Widgets for Elementor

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update ThemeShark Templates & Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Meta Store Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51592 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mystical Themes Meta Store Elements meta-store-elements allows DOM-Based XSS.This issue affects Meta Store Elements: from n/a through <= 1.0.9.

  Product

  Meta Store Elements

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Meta Store Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Hoo Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51590 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HooThemes Hoo Addons for Elementor hoo-addons-for-elementor allows DOM-Based XSS.This issue affects Hoo Addons for Elementor: from n/a through <= 1.0.6.

  Product

  Hoo Addons for Elementor

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Hoo Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Super Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51588 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riponhossain Super Addons for Elementor super-addons-for-elementor allows DOM-Based XSS.This issue affects Super Addons for Elementor: from n/a through <= 1.0.

  Product

  Super Addons for Elementor

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Super Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Definitive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51587 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softfirm Definitive Addons for Elementor definitive-addons-for-elementor allows Stored XSS.This issue affects Definitive Addons for Elementor: from n/a through <= 1.5.16.

  Product

  Definitive Addons for Elementor

  Affected

  up to 1.5.16

  What to do

  Affects up to 1.5.16. Update Definitive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Sales Page Addon – Elementor & Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51585 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Sales Page Addon – Elementor & Beaver Builder sales-page-addon allows Stored XSS.This issue affects Sales Page Addon – Elementor & Beaver Builder: from n/a through <= 1.4.5.

  Product

  Sales Page Addon – Elementor & Beaver Builder

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Sales Page Addon – Elementor & Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024MyCurator Content Curation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51668 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mtilly MyCurator Content Curation mycurator allows Stored XSS.This issue affects MyCurator Content Curation: from n/a through <= 3.78.

  Product

  MyCurator Content Curation

  Affected

  up to 3.78

  What to do

  Affects up to 3.78. Update MyCurator Content Curation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51662 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.6.

  Product

  Black Widgets For Elementor

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Header Footer Composer for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51629 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MetricThemes Header Footer Composer for Elementor header-footer-composer allows DOM-Based XSS.This issue affects Header Footer Composer for Elementor: from n/a through <= 1.0.4.

  Product

  Header Footer Composer for Elementor

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Header Footer Composer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024MG Post Contributors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51701 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through <= 1.3..

  Product

  MG Post Contributors

  Affected

  up to 1.3.

  What to do

  Affects up to 1.3.. Update MG Post Contributors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51675 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows DOM-Based XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.7.

  Product

  aThemes Addons for Elementor

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Sastra Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fast Themes Sastra Essential Addons for Elementor sastra-essential-addons-for-elementor allows DOM-Based XSS.This issue affects Sastra Essential Addons for Elementor: from n/a through <= 1.0.5.

  Product

  Sastra Essential Addons for Elementor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Sastra Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Jigoshop – Store Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51712 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Visser Jigoshop – Store Toolkit jigoshop-store-toolkit allows Reflected XSS.This issue affects Jigoshop – Store Toolkit: from n/a through <= 1.4.0.

  Product

  Jigoshop – Store Toolkit

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Jigoshop – Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Magical Addons For Elementor: Sensitive Information ExposureCVE-2024-10352 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the get_content_type function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.

  Product

  Magical Addons For Elementor

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 9, 2024Administrator Z: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50524 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quý Lê 91 Administrator Z administrator-z allows Blind SQL Injection.This issue affects Administrator Z: from n/a through < 2024.10.21.

  Product

  Administrator Z

  What to do

  Update Administrator Z to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51787 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.3.

  Product

  ElementsReady Addons for Elementor

  Affected

  up to 6.4.3

  What to do

  Affects up to 6.4.3. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024FriendStore for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51784 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VietFriend team FriendStore for WooCommerce friendstore-for-woocommerce allows Reflected XSS.This issue affects FriendStore for WooCommerce: from n/a through <= 1.4.2.

  Product

  FriendStore for WooCommerce

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update FriendStore for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Website price calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51601 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Maksym Marko Website price calculator price-calculator-to-your-website allows SQL Injection.This issue affects Website price calculator: from n/a through <= 4.1.

  Product

  Website price calculator

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Website price calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 8, 2024SKT Addons for Elementor: Information ExposureCVE-2024-10693 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

  Product

  SKT Addons for Elementor

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 8, 2024Top Store: Unauthorized arbitrary plugin installationCVE-2024-10673 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.

  Product

  Top Store

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Top Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemes.trac.wordpress.orgwordfence.com

• Nov 8, 2024Anih - Creative Agency: Stored Cross-Site ScriptingCVE-2024-9775 · WordPress plugins & themes · reported by WordfenceMedium 5.5

  The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2024 due to an incomplete blacklist, insufficient input sanitization, and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  Anih - Creative Agency

  Affected

  up to 2024

  What to do

  Affects up to 2024. Update Anih - Creative Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Nov 8, 2024Lenxel Core for Lenxel(LNX) LMS: Stored Cross-Site ScriptingCVE-2024-9270 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  Lenxel Core for Lenxel(LNX) LMS

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 8, 2024Cowidgets – Elementor Addons: Stored Cross-Site ScriptingCVE-2024-8960 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  Cowidgets – Elementor Addons

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 8, 2024Cowidgets – Elementor Addons: Information ExposureCVE-2024-10779 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

  Product

  Cowidgets – Elementor Addons

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Nov 8, 2024Elementor Header & Footer Builder: Stored Cross-Site ScriptingCVE-2024-10325 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  Elementor Header & Footer Builder

  Affected

  up to 1.6.45

  What to do

  Affects up to 1.6.45. Update Elementor Header & Footer Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 8, 2024Easy SVG Support: Stored Cross-Site ScriptingCVE-2024-10269 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  Easy SVG Support

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update Easy SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 8, 2024Simple Shortcode for Google Maps: Stored Cross-Site ScriptingCVE-2024-10621 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Simple Shortcode for Google Maps

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Simple Shortcode for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 7, 2024Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider): Stored Cross-Site ScriptingCVE-2024-8442 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)

  Affected

  up to 3.15.18

  What to do

  Affects up to 3.15.18. Update Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 6, 2024Event post: Stored Cross-Site ScriptingCVE-2024-10186 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5.9.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Event post

  Affected

  up to 5.9.6

  What to do

  Affects up to 5.9.6. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 6, 2024Pricing Tables WordPress Plugin – Easy Pricing Tables: Stored Cross-Site ScriptingCVE-2024-8323 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Pricing Tables WordPress Plugin – Easy Pricing Tables

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update Pricing Tables WordPress Plugin – Easy Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 6, 2024Active Products Tables for WooCommerce. Use constructor to create tables: Stored Cross-Site ScriptingCVE-2024-10168 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woot_button shortcode in all versions up to, and including, 1.0.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Active Products Tables for WooCommerce. Use constructor to create tables

  Affected

  up to 1.0.6.4

  What to do

  Affects up to 1.0.6.4. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 6, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2024-10715 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions up to, and including, 2.94.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  MapPress Maps for

  Affected

  up to 2.94.1

  What to do

  Affects up to 2.94.1. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 6, 2024EleForms – All In One Form Integration including DB for Elementor: Unauthorized access of dataCVE-2024-6626 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions.

  Product

  EleForms – All In One Form Integration including DB for Elementor

  Affected

  up to 2.9.9.9

  What to do

  Affects up to 2.9.9.9. Update EleForms – All In One Form Integration including DB for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.