Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

486new WordPress flaws this week

392,772entries in the database

9,260 results · page 130 of 186

Nov 9, 2024Display Terms Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes Display Terms Shortcode display-terms-shortcode allows Stored XSS.This issue affects Display Terms Shortcode: from n/a through <= 1.0.4.
Product
Display Terms Shortcode
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Display Terms Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Emoji Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Emoji Shortcode emoji-shortcode allows Stored XSS.This issue affects Emoji Shortcode: from n/a through <= 1.0.0.
Product
Emoji Shortcode
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Emoji Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024AmaDiscount: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51608 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in colinph970 AmaDiscount amadiscount allows SQL Injection.This issue affects AmaDiscount: from n/a through <= 1.0.
Product
AmaDiscount
Affected
up to 1.0
What to do
Affects up to 1.0. Update AmaDiscount to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Blrt WP Embed: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51606 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Blrt Blrt WP Embed blrt-wp-embed allows SQL Injection.This issue affects Blrt WP Embed: from n/a through <= 1.6.9.
Product
Blrt WP Embed
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Blrt WP Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Genoo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51605 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genoo Genoo genoo allows DOM-Based XSS.This issue affects Genoo: from n/a through <= 6.0.10.
Product
Genoo
Affected
up to 6.0.10
What to do
Affects up to 6.0.10. Update Genoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Media Modal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51604 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmabugay Media Modal media-modal allows DOM-Based XSS.This issue affects Media Modal: from n/a through <= 1.0.2.
Product
Media Modal
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Media Modal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024NMR Strava activities: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51603 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through <= 1.0.7.
Product
NMR Strava activities
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update NMR Strava activities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Simple Business Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51599 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in russell.albin Simple Business Manager simple-business-manager allows Stored XSS.This issue affects Simple Business Manager: from n/a through <= 4.6.7.4.
Product
Simple Business Manager
Affected
up to 4.6.7.4
What to do
Affects up to 4.6.7.4. Update Simple Business Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Selar.co Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kendysond Selar.co Widget selar-co-widget allows DOM-Based XSS.This issue affects Selar.co Widget: from n/a through <= 1.2.
Product
Selar.co Widget
Affected
up to 1.2
What to do
Affects up to 1.2. Update Selar.co Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024ThemeShark Templates & Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeshark ThemeShark Templates & Widgets for Elementor themeshark-elementor allows Stored XSS.This issue affects ThemeShark Templates & Widgets for Elementor: from n/a through <= 1.1.7.
Product
ThemeShark Templates & Widgets for Elementor
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update ThemeShark Templates & Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Business: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51596 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nilesh Shiragave Business business allows Stored XSS.This issue affects Business: from n/a through <= 1.3.
Product
Business
Affected
up to 1.3
What to do
Affects up to 1.3. Update Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024SKSDEV Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKSDEV SKSDEV Toolkit sksdev-toolkit allows Stored XSS.This issue affects SKSDEV Toolkit: from n/a through <= 1.0.0.
Product
SKSDEV Toolkit
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update SKSDEV Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Gmap Point List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rafel.sanso Gmap Point List gmap-point-list allows Stored XSS.This issue affects Gmap Point List: from n/a through <= 1.1.2.
Product
Gmap Point List
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Gmap Point List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Курс валют UAH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glopium Курс валют UAH ukrainian-currency allows Stored XSS.This issue affects Курс валют UAH: from n/a through <= 2.0.
Product
Курс валют UAH
Affected
up to 2.0
What to do
Affects up to 2.0. Update Курс валют UAH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Meta Store Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mystical Themes Meta Store Elements meta-store-elements allows DOM-Based XSS.This issue affects Meta Store Elements: from n/a through <= 1.0.9.
Product
Meta Store Elements
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Meta Store Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Slicko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51591 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids Slicko slicko-for-elementor allows DOM-Based XSS.This issue affects Slicko: from n/a through <= 1.2.0.
Product
Slicko
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Slicko to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Hoo Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51590 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HooThemes Hoo Addons for Elementor hoo-addons-for-elementor allows DOM-Based XSS.This issue affects Hoo Addons for Elementor: from n/a through <= 1.0.6.
Product
Hoo Addons for Elementor
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Hoo Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Bigmart Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcirqle Bigmart Elements bigmart-elements allows DOM-Based XSS.This issue affects Bigmart Elements: from n/a through <= 1.0.3.
Product
Bigmart Elements
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Bigmart Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Super Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riponhossain Super Addons for Elementor super-addons-for-elementor allows DOM-Based XSS.This issue affects Super Addons for Elementor: from n/a through <= 1.0.
Product
Super Addons for Elementor
Affected
up to 1.0
What to do
Affects up to 1.0. Update Super Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Definitive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51587 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softfirm Definitive Addons for Elementor definitive-addons-for-elementor allows Stored XSS.This issue affects Definitive Addons for Elementor: from n/a through <= 1.5.16.
Product
Definitive Addons for Elementor
Affected
up to 1.5.16
What to do
Affects up to 1.5.16. Update Definitive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Elementary Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in camilluskillus Elementary Addons elementary-addons allows Stored XSS.This issue affects Elementary Addons: from n/a through <= 2.0.4.
Product
Elementary Addons
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Elementary Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Sales Page Addon – Elementor & Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Sales Page Addon – Elementor & Beaver Builder sales-page-addon allows Stored XSS.This issue affects Sales Page Addon – Elementor & Beaver Builder: from n/a through <= 1.4.5.
Product
Sales Page Addon – Elementor & Beaver Builder
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Sales Page Addon – Elementor & Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024MyCurator Content Curation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51668 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mtilly MyCurator Content Curation mycurator allows Stored XSS.This issue affects MyCurator Content Curation: from n/a through <= 3.78.
Product
MyCurator Content Curation
Affected
up to 3.78
What to do
Affects up to 3.78. Update MyCurator Content Curation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51664 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.25.
Product
Beds24 Online Booking
Affected
up to 2.0.25
What to do
Affects up to 2.0.25. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Bricksable for Bricks Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51663 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable Bricksable for Bricks Builder bricksable allows Stored XSS.This issue affects Bricksable for Bricks Builder: from n/a through <= 1.6.59.
Product
Bricksable for Bricks Builder
Affected
up to 1.6.59
What to do
Affects up to 1.6.59. Update Bricksable for Bricks Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.6.
Product
Black Widgets For Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Header Footer Composer for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51629 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MetricThemes Header Footer Composer for Elementor header-footer-composer allows DOM-Based XSS.This issue affects Header Footer Composer for Elementor: from n/a through <= 1.0.4.
Product
Header Footer Composer for Elementor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Header Footer Composer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024EzyOnlineBookings Online Booking System Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51628 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EzyOnlineBookings EzyOnlineBookings Online Booking System Widget ezyonlinebookings-online-booking-system allows DOM-Based XSS.This issue affects EzyOnlineBookings Online Booking System Widget: from n/a through <= 1.3.
Product
EzyOnlineBookings Online Booking System Widget
Affected
up to 1.3
What to do
Affects up to 1.3. Update EzyOnlineBookings Online Booking System Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Audio Comparison Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51627 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kaedinger Audio Comparison Lite audio-comparison-lite allows Stored XSS.This issue affects Audio Comparison Lite: from n/a through <= 3.4.
Product
Audio Comparison Lite
Affected
up to 3.4
What to do
Affects up to 3.4. Update Audio Comparison Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP EIS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51623 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mehral WP EIS wp-eis allows SQL Injection.This issue affects WP EIS: from n/a through <= 1.3.3.
Product
WP EIS
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WP EIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP EASY RECIPE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51622 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN WP EASY RECIPE wp-easy-recipe allows Stored XSS.This issue affects WP EASY RECIPE: from n/a through <= 1.6.
Product
WP EASY RECIPE
Affected
up to 1.6
What to do
Affects up to 1.6. Update WP EASY RECIPE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Custom Admin Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51618 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Admin Menu custom-admin-menu allows Stored XSS.This issue affects Custom Admin Menu: from n/a through <= 1.0.0.
Product
Custom Admin Menu
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024AwesomePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rupok AwesomePress awesomepress allows Stored XSS.This issue affects AwesomePress: from n/a through <= 1.0.
Product
AwesomePress
Affected
up to 1.0
What to do
Affects up to 1.0. Update AwesomePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Aajoda Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aajoda Aajoda Testimonials aajoda-testimonials allows Stored XSS.This issue affects Aajoda Testimonials: from n/a through <= 2.2.2.
Product
Aajoda Testimonials
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Aajoda Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024TradeMe widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bidbud TradeMe widgets trademe-widget allows Stored XSS.This issue affects TradeMe widgets: from n/a through <= 1.2.
Product
TradeMe widgets
Affected
up to 1.2
What to do
Affects up to 1.2. Update TradeMe widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Reftagger Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51612 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designerken Reftagger Shortcode reftagger-shortcode allows Stored XSS.This issue affects Reftagger Shortcode: from n/a through <= 1.1.
Product
Reftagger Shortcode
Affected
up to 1.1
What to do
Affects up to 1.1. Update Reftagger Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP Feature Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51611 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Peixe WP Feature Box wp-feature-box allows Stored XSS.This issue affects WP Feature Box: from n/a through <= 0.1.3.
Product
WP Feature Box
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update WP Feature Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024UW Freelancer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Upeksha Wisidagama UW Freelancer uw-freelancer allows Reflected XSS.This issue affects UW Freelancer: from n/a through <= 0.1.
Product
UW Freelancer
Affected
up to 0.1
What to do
Affects up to 0.1. Update UW Freelancer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP MMenu Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP MMenu Lite wp-mmenu-lite allows Reflected XSS.This issue affects WP MMenu Lite: from n/a through <= 1.0.0.
Product
WP MMenu Lite
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP MMenu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024imPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51704 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John Hanusek imPress wp-js-impress allows Reflected XSS.This issue affects imPress: from n/a through <= 0.1.4.
Product
imPress
Affected
up to 0.1.4
What to do
Affects up to 0.1.4. Update imPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP-Basics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51703 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in laura20 WP-Basics wp-basics allows Reflected XSS.This issue affects WP-Basics: from n/a through <= 2.0.
Product
WP-Basics
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP-Basics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024SrcSet Responsive Images for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ben.moody SrcSet Responsive Images for WordPress truenorth-srcset allows Reflected XSS.This issue affects SrcSet Responsive Images for WordPress: from n/a through <= 1.4.
Product
SrcSet Responsive Images for
Affected
up to 1.4
What to do
Affects up to 1.4. Update SrcSet Responsive Images for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024MG Post Contributors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51701 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through <= 1.3..
Product
MG Post Contributors
Affected
up to 1.3.
What to do
Affects up to 1.3.. Update MG Post Contributors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Buooy Sticky Header: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51699 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buooy Buooy Sticky Header buooy-sticky-header allows Reflected XSS.This issue affects Buooy Sticky Header: from n/a through <= 0.5.2.
Product
Buooy Sticky Header
Affected
up to 0.5.2
What to do
Affects up to 0.5.2. Update Buooy Sticky Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Master Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51698 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Bar master-bar allows Reflected XSS.This issue affects Master Bar: from n/a through <= 1.0.
Product
Master Bar
Affected
up to 1.0
What to do
Affects up to 1.0. Update Master Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Doofinder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder doofinder allows Reflected XSS.This issue affects Doofinder: from n/a through <= 0.5.4.
Product
Doofinder
Affected
up to 0.5.4
What to do
Affects up to 0.5.4. Update Doofinder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Content Syndication Toolkit Reader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ben.moody Content Syndication Toolkit Reader content-syndication-toolkit-reader allows Reflected XSS.This issue affects Content Syndication Toolkit Reader: from n/a through <= 1.5.
Product
Content Syndication Toolkit Reader
Affected
up to 1.5
What to do
Affects up to 1.5. Update Content Syndication Toolkit Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Fabrica Synced Pattern Instances: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yes We Work Fabrica Synced Pattern Instances fabrica-reusable-block-instances allows Reflected XSS.This issue affects Fabrica Synced Pattern Instances: from n/a through <= 1.0.8.
Product
Fabrica Synced Pattern Instances
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Fabrica Synced Pattern Instances to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Geotagged Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalfisherman Geotagged Media geotagged-media allows Reflected XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
Product
Geotagged Media
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Search order by product SKU for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51693 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in labdav Search order by product SKU for WooCommerce search-order-by-product-sku-for-woocommerce allows Reflected XSS.This issue affects Search order by product SKU for WooCommerce: from n/a through <= 0.2.
Product
Search order by product SKU for WooCommerce
Affected
up to 0.2
What to do
Affects up to 0.2. Update Search order by product SKU for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.