Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 13 of 39
Jan 31, 2025Privacy Policy Genius: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13219 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Privacy Policy Genius
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Privacy Policy Genius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Fast Tube: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Fast Tube
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Fast Tube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025OPSI Israel Domestic Shipments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- OPSI Israel Domestic Shipments
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update OPSI Israel Domestic Shipments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Zalomení: Does not sanitise and escape some of its settingsCVE-2024-12872 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Zalomení
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Zalomení to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Canvasflow for: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Canvasflow for
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Canvasflow for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Bulk Me Now!: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12638 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Bulk Me Now!
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Tracking Code Manager: Does not sanitise and escape some of its metabox settingsCVE-2024-10309 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Tracking Code Manager
- Fixed in
- 2.4.0
- What to do
- Update Tracking Code Manager to 2.4.0 or newer.
Jan 29, 2025Competition Form: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12749 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Competition Form
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Competition Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2025Social Share Buttons for: Does not sanitise and escape some of its settingsCVE-2024-12807 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Share Buttons for
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2025Infility Global: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12723 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Infility Global
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Multistore Locator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24680 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.
- Product
- WP Multistore Locator
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-13116 · WordPress plugins & themes · reported by WPScanLow 3.8
The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Crelly Slider
- Fixed in
- 1.4.7
- What to do
- Update Crelly Slider to 1.4.7 or newer.
Jan 27, 2025WP Triggers Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13094 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Triggers Lite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13055 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dental Optimizer Patient Generator App: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13052 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dental Optimizer Patient Generator App
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dental Optimizer Patient Generator App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WC Affiliate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12321 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WC Affiliate
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24675 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.2.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 7.2
- What to do
- Affects up to 7.2. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025TRUSTist REVIEWer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through <= 2.0.
- Product
- TRUSTist REVIEWer
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update TRUSTist REVIEWer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Workflow settingsCVE-2024-12568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its form settingsCVE-2024-12567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of form settingsCVE-2024-12566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Text Block optionsCVE-2024-11636 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 11, 2025Contact Form Master: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12587 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Contact Form Master
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Contact Form Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025BU Section Editing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12736 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- BU Section Editing
- Affected
- up to 0.9.9
- What to do
- Affects up to 0.9.9. Update BU Section Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12731 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape some of its settingsCVE-2024-12717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Asgard Security Scanner: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12715 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Asgard Security Scanner
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Asgard Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Backlink Monitoring Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12714 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Backlink Monitoring Manager
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Backlink Monitoring Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025Property Hive: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12585 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Property Hive
- Fixed in
- 2.1.1
- What to do
- Update Property Hive to 2.1.1 or newer.
Jan 7, 2025Wp advertising management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-management allows Reflected XSS.This issue affects Wp advertising management: from n/a through <= 1.0.3.
- Product
- Wp advertising management
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Wp advertising management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-22304 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.5.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 7.5
- What to do
- Affects up to 7.5. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025MIPL WC Multisite Sync: Directory TraversalCVE-2024-12152 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- MIPL WC Multisite Sync
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update MIPL WC Multisite Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Category Posts Widget: Does not sanitise and escape some of its settingsCVE-2024-9638 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Category Posts Widget
- Fixed in
- 4.9.18
- What to do
- Update Category Posts Widget to 4.9.18 or newer.
Jan 7, 2025WordPress Auction: Does not sanitise and escape some of its settingsCVE-2024-8857 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress Auction
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10562 · WordPress plugins & themes · reported by WPScanLow 2.7
The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.31
- What to do
- Update Form Maker by 10Web to 1.15.31 or newer.
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.22
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Jan 6, 2025Icegram Engage: Does not sanitise and escape some of its Campaign settingsCVE-2024-12302 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
Jan 6, 2025Pods: Does not sanitise and escape some of its settingsCVE-2024-11849 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pods
- Fixed in
- 3.2.8.1
- What to do
- Update Pods to 3.2.8.1 or newer.
Jan 6, 2025tourmaster: Does not sanitise and escape some parametersCVE-2024-11356 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- tourmaster
- Fixed in
- 5.3.4
- What to do
- Update tourmaster to 5.3.4 or newer.
Jan 2, 2025Just Writing Statistics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56250 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows SQL Injection.This issue affects Just Writing Statistics: from n/a through <= 4.7.
- Product
- Just Writing Statistics
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update Just Writing Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Visitors Traffic Real Time Statistics: Missing AuthorizationCVE-2023-47557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/a through <= 7.2.
- Product
- Visitors Traffic Real Time Statistics
- Affected
- up to 7.2
- What to do
- Affects up to 7.2. Update Visitors Traffic Real Time Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025goodlayers-core: Does not sanitise and escape some of its settingsCVE-2024-11357 · WordPress plugins & themes · reported by WPScanMedium 5.9
The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- goodlayers-core
- Fixed in
- 2.0.10
- What to do
- Update goodlayers-core to 2.0.10 or newer.
Jan 1, 2025The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against higCVE-2024-11846 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Dec 27, 2024GiveWP: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-11921 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- GiveWP
- Fixed in
- 3.19.0
- What to do
- Update GiveWP to 3.19.0 or newer.
Dec 27, 2024float block: Does not sanitise and escape some of its settingsCVE-2024-11645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- float block
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update float block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-11223 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPForms
- Fixed in
- 1.9.2.3
- What to do
- Update WPForms to 1.9.2.3 or newer.
Dec 24, 2024Exhibit to WP Gallery: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12096 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Exhibit to WP Gallery
- Affected
- up to 0.0.2
- What to do
- Affects up to 0.0.2. Update Exhibit to WP Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2024Optio Dentistry: Stored Cross-Site ScriptingCVE-2024-12507 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Optio Dentistry
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Optio Dentistry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.