Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

5,867 results · page 111 of 118

Feb 10, 2024Pay with Vipps and MobilePay for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51485 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Hosting Pay with Vipps and MobilePay for WooCommerce allows Stored XSS.This issue affects Pay with Vipps and MobilePay for WooCommerce: from n/a through 1.14.13.
Product
Pay with Vipps and MobilePay for WooCommerce
Affected
up to 1.14.13
What to do
Affects up to 1.14.13. Update Pay with Vipps and MobilePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store allows Stored XSS.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024GiveWP – Donation Plugin and Fundraising Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51415 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024My Agile Privacy – The only GDPR solution for WordPress that you can truly trust: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyAgilePrivacy My Agile Privacy – The only GDPR solution for WordPress that you can truly trust allows Stored XSS.This issue affects My Agile Privacy – The only GDPR solution for WordPress that you can truly trust: from n/a through 2.1.7.
Product
My Agile Privacy – The only GDPR solution for WordPress that you can truly trust
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update My Agile Privacy – The only GDPR solution for WordPress that you can truly trust to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24831 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.16.
Product
Premium Addons for Elementor
Affected
up to 4.10.16
What to do
Affects up to 4.10.16. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024MW WP Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24804 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6.
Product
MW WP Form
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024Ultra Companion – Companion plugin for WPoperation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPoperation Ultra Companion – Companion plugin for WPoperation Themes allows Stored XSS.This issue affects Ultra Companion – Companion plugin for WPoperation Themes: from n/a through 1.1.9.
Product
Ultra Companion – Companion plugin for WPoperation
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Ultra Companion – Companion plugin for WPoperation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024OWL Carousel – WordPress Owl Carousel Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24801 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt OWL Carousel – WordPress Owl Carousel Slider allows Stored XSS.This issue affects OWL Carousel – WordPress Owl Carousel Slider: from n/a through 1.4.0.
Product
OWL Carousel – WordPress Owl Carousel Slider
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update OWL Carousel – WordPress Owl Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24717 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.23.
Product
Beds24 Online Booking
Affected
up to 2.0.23
What to do
Affects up to 2.0.23. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024Auto Listings – Car Listings & Car Dealership Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24713 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Auto Listings Auto Listings – Car Listings & Car Dealership Plugin for WordPress allows Stored XSS.This issue affects Auto Listings – Car Listings & Car Dealership Plugin for WordPress: from n/a through 2.6.5.
Product
Auto Listings – Car Listings & Car Dealership Plugin for
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Auto Listings – Car Listings & Car Dealership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024Heateor Social Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24712 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login WordPress allows Stored XSS.This issue affects Heateor Social Login WordPress: from n/a through 1.1.30.
Product
Heateor Social Login
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24834 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net allows Stored XSS.This issue affects BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.
Product
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Portugal CTT Tracking for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24878 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Almeida | Webdados Portugal CTT Tracking for WooCommerce portugal-ctt-tracking-woocommerce.This issue affects Portugal CTT Tracking for WooCommerce: from n/a through <= 2.1.
Product
Portugal CTT Tracking for WooCommerce
Affected
up to 2.1
What to do
Affects up to 2.1. Update Portugal CTT Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Wonder Slider Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24877 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9.
Product
Wonder Slider Lite
Affected
up to 13.9
What to do
Affects up to 13.9. Update Wonder Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Blocksy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24871 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.19.
Product
Blocksy
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024GDPR Data Request Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24836 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Audrasjb GDPR Data Request Form allows Stored XSS.This issue affects GDPR Data Request Form: from n/a through 1.6.
Product
GDPR Data Request Form
Affected
up to 1.6
What to do
Affects up to 1.6. Update GDPR Data Request Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Woocommerce Vietnam Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24885 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lê Văn Toản Woocommerce Vietnam Checkout allows Stored XSS.This issue affects Woocommerce Vietnam Checkout: from n/a through 2.0.7.
Product
Woocommerce Vietnam Checkout
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Woocommerce Vietnam Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24881 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Apollo13 Framework Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2.
Product
Apollo13 Framework Extensions
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24879 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.5.13.
Product
Link Library
Affected
up to 7.5.13
What to do
Affects up to 7.5.13. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024Product Labels For Woocommerce (Sale Badges): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24886 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Labels For Woocommerce (Sale Badges) allows Stored XSS.This issue affects Product Labels For Woocommerce (Sale Badges): from n/a through 1.5.3.
Product
Product Labels For Woocommerce (Sale Badges)
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Product Labels For Woocommerce (Sale Badges) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Scroll Triggered Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This issue affects Scroll Triggered Box: from n/a through 2.3.
Product
Scroll Triggered Box
Affected
up to 2.3
What to do
Affects up to 2.3. Update Scroll Triggered Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024PT Sign Ups – Beautiful volunteer sign ups and management made easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a through 1.0.4.
Product
PT Sign Ups – Beautiful volunteer sign ups and management made easy
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update PT Sign Ups – Beautiful volunteer sign ups and management made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024CalculatorPro Calculators: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24847 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgadbois CalculatorPro Calculators allows Reflected XSS.This issue affects CalculatorPro Calculators: from n/a through 1.1.7.
Product
CalculatorPro Calculators
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update CalculatorPro Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Mighty Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24846 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Addons for Elementor allows Reflected XSS.This issue affects Mighty Addons for Elementor: from n/a through 1.9.3.
Product
Mighty Addons for Elementor
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Mighty Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Add Customer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24841 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan's Art Add Customer for WooCommerce allows Stored XSS.This issue affects Add Customer for WooCommerce: from n/a through 1.7.
Product
Add Customer for WooCommerce
Affected
up to 1.7
What to do
Affects up to 1.7. Update Add Customer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Structured Content (JSON-LD) #wpsc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24839 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.6.1.
Product
Structured Content (JSON-LD) #wpsc
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Five Star Restaurant Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Reviews allows Stored XSS.This issue affects Five Star Restaurant Reviews: from n/a through 2.3.5.
Product
Five Star Restaurant Reviews
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Five Star Restaurant Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.
Product
Advanced iFrame
Affected
up to 2023.10
What to do
Affects up to 2023.10. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
Product
Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
Affected
up to 2.2.24
What to do
Affects up to 2.2.24. Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Dan's Embedder for Google Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Stored XSS.This issue affects Dan's Embedder for Google Calendar: from n/a through 1.2.
Product
Dan's Embedder for Google Calendar
Affected
up to 1.2
What to do
Affects up to 1.2. Update Dan's Embedder for Google Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024WP Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51520 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7.4.
Product
WP Booking Calendar
Fixed in
9.7.4
What to do
Update WP Booking Calendar to 9.7.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024CBX Bookmark & Favorite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.13.
Product
CBX Bookmark & Favorite
Affected
up to 1.7.13
What to do
Affects up to 1.7.13. Update CBX Bookmark & Favorite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Reflected XSS.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.1.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.2.4.1
What to do
Affects up to 5.2.4.1. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024WPCS – WordPress Currency Switcher Professional: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51506 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024WP User Profile Avatar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52118 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.
Product
WP User Profile Avatar
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored XSS.This issue affects Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: from n/a through 2.0.4.1.
Product
Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
Affected
up to 2.0.4.1
What to do
Affects up to 2.0.4.1. Update Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Embed Privacy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51694 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.
Product
Embed Privacy
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Embed Privacy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Themify Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51693 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themify Icons: from n/a through 2.0.1.
Product
Themify Icons
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Themify Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Comments – wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51691 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12.
Product
Comments – wpDiscuz
Affected
up to 7.6.12
What to do
Affects up to 7.6.12. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51690 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.8.
Product
Advanced iFrame
Affected
up to 2023.8
What to do
Affects up to 2023.8. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Easy Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.
Product
Easy Video Player
Affected
up to 1.2.2.10
What to do
Affects up to 1.2.2.10. Update Easy Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024WP Review Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51685 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LJ Apps WP Review Slider allows Stored XSS.This issue affects WP Review Slider: from n/a through 12.7.
Product
WP Review Slider
Affected
up to 12.7
What to do
Affects up to 12.7. Update WP Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.
Product
Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51677 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.23
What to do
Affects up to 1.23. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Product Code for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51669 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored XSS.This issue affects Product Code for WooCommerce: from n/a through 1.4.4.
Product
Product Code for WooCommerce
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Product Code for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Related Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51666 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.
Product
Related Post
Affected
up to 2.0.53
What to do
Affects up to 2.0.53. Update Related Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024SlickNav Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51548 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neil Gee SlickNav Mobile Menu allows Stored XSS.This issue affects SlickNav Mobile Menu: from n/a through 1.9.2.
Product
SlickNav Mobile Menu
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update SlickNav Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Custom 404 Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51540 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Nagar Custom 404 Pro allows Stored XSS.This issue affects Custom 404 Pro: from n/a through 3.10.0.
Product
Custom 404 Pro
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.