Vulnerability database

8,937 results · page 130 of 179

• Oct 20, 2024SSV Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49286 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through <= 3.2.7.

  Product

  SSV Events

  Affected

  up to 3.2.7

  What to do

  Affects up to 3.2.7. Update SSV Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 20, 2024Mighty Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48049 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Stored XSS.This issue affects Mighty Builder: from n/a through <= 1.0.2.

  Product

  Mighty Builder

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Mighty Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Movie Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43300 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This issue affects Movie Database: from n/a through <= 1.0.11.

  Product

  Movie Database

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Movie Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Dynamic Elementor Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49243 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dynamic-elementor-addons allows PHP Local File Inclusion.This issue affects Dynamic Elementor Addons: from n/a through <= 1.0.0.

  Product

  Dynamic Elementor Addons

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Dynamic Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Tito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49241 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tady Tito tito allows DOM-Based XSS.This issue affects Tito: from n/a through <= 2.3.

  Product

  Tito

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Tito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024AB Categories Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49240 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through <= 0.2.5.

  Product

  AB Categories Search Widget

  Affected

  up to 0.2.5

  What to do

  Affects up to 0.2.5. Update AB Categories Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Add Categories Post Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49239 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through <= 2.2.2.

  Product

  Add Categories Post Footer

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Add Categories Post Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024ADIF Log Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49238 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allows Reflected XSS.This issue affects ADIF Log Search Widget: from n/a through <= 1.0f.

  Product

  ADIF Log Search Widget

  Affected

  up to 1.0f

  What to do

  Affects up to 1.0f. Update ADIF Log Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Crazy Call To Action Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49236 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through <= 1.0.5.

  Product

  Crazy Call To Action Box

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Crazy Call To Action Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Plexx Elementor Extension: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49234 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeworm Plexx Elementor Extension plexx-elementor-extension allows DOM-Based XSS.This issue affects Plexx Elementor Extension: from n/a through <= 1.3.6.

  Product

  Plexx Elementor Extension

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Plexx Elementor Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024MAS Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49233 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MadrasThemes MAS Elementor mas-addons-for-elementor allows DOM-Based XSS.This issue affects MAS Elementor: from n/a through <= 1.1.6.

  Product

  MAS Elementor

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update MAS Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024El mejor Cluster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49232 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based XSS.This issue affects El mejor Cluster: from n/a through <= 1.1.15.

  Product

  El mejor Cluster

  Affected

  up to 1.1.15

  What to do

  Affects up to 1.1.15. Update El mejor Cluster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024WordPress Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49231 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video allows Stored XSS.This issue affects WordPress Video: from n/a through <= 1.0.

  Product

  WordPress Video

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WordPress Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Ajax Custom CSS/JS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49230 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through <= 2.0.4.

  Product

  Ajax Custom CSS/JS

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Ajax Custom CSS/JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024bVerse Convert: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49228 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edwin Rivera bVerse Convert bverse-convert allows Stored XSS.This issue affects bVerse Convert: from n/a through <= 1.3.7.1.

  Product

  bVerse Convert

  Affected

  up to 1.3.7.1

  What to do

  Affects up to 1.3.7.1. Update bVerse Convert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024wpPricing Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49225 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-responsive-pricing-table-builder allows Stored XSS.This issue affects wpPricing Builder: from n/a through <= 1.5.0.

  Product

  wpPricing Builder

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update wpPricing Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 18, 2024Mitm Bug Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49224 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through <= 1.0.

  Product

  Mitm Bug Tracker

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Mitm Bug Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Email Template Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49288 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.9.1.

  Product

  Email Template Customizer for WooCommerce

  Affected

  up to 1.2.9.1

  What to do

  Affects up to 1.2.9.1. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024CURCY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49283 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows Reflected XSS.This issue affects CURCY: from n/a through <= 2.2.3.

  Product

  CURCY

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Responsive Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49282 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows Stored XSS.This issue affects Responsive Lightbox: from n/a through <= 2.4.8.

  Product

  Responsive Lightbox

  Affected

  up to 2.4.8

  What to do

  Affects up to 2.4.8. Update Responsive Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-49281 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.3.

  Product

  Click to Chat – WP Support All-in-One Floating Widget

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Lightbox slider – Responsive Lightbox Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49280 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery allows Stored XSS.This issue affects Lightbox slider – Responsive Lightbox Gallery: from n/a through <= 1.10.6.

  Product

  Lightbox slider – Responsive Lightbox Gallery

  Affected

  up to 1.10.6

  What to do

  Affects up to 1.10.6. Update Lightbox slider – Responsive Lightbox Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Hyperlink Group Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49279 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through <= 1.17.5.

  Product

  Hyperlink Group Block

  Affected

  up to 1.17.5

  What to do

  Affects up to 1.17.5. Update Hyperlink Group Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49278 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.4.3.

  Product

  Omnipress

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024UltraAddons Elementor Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49277 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.

  Product

  UltraAddons Elementor Lite

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update UltraAddons Elementor Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Clio Grow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49276 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cliogrow Clio Grow clio-grow-form allows Reflected XSS.This issue affects Clio Grow: from n/a through <= 1.0.2.

  Product

  Clio Grow

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Clio Grow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Events Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49264 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows Stored XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.0.

  Product

  Events Addon for Elementor

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024My Favorites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows Stored XSS.This issue affects My Favorites: from n/a through <= 1.4.1.

  Product

  My Favorites

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update My Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Country Flags for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49262 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wepic Country Flags for Elementor allows Stored XSS.This issue affects Country Flags for Elementor: from n/a through 1.0.1.

  Product

  Country Flags for Elementor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Country Flags for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Arkhe Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49261 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks.This issue affects Arkhe Blocks: from n/a through <= 2.23.0.

  Product

  Arkhe Blocks

  Affected

  up to 2.23.0

  What to do

  Affects up to 2.23.0. Update Arkhe Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49259 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5.8.

  Product

  Primary Addon for Elementor

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Da Reactions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49255 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Stored XSS.This issue affects Da Reactions: from n/a through <= 5.1.5.

  Product

  Da Reactions

  Affected

  up to 5.1.5

  What to do

  Affects up to 5.1.5. Update Da Reactions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49248 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through <= 2.7.37.

  Product

  Ad Inserter

  Affected

  up to 2.7.37

  What to do

  Affects up to 2.7.37. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Awesome Contact Form7 for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49319 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awesome-contact-form7-for-elementor.This issue affects Awesome Contact Form7 for Elementor: from n/a through <= 3.0.

  Product

  Awesome Contact Form7 for Elementor

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Awesome Contact Form7 for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Akismet htaccess writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49316 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer akismet-htaccess-writer allows Reflected XSS.This issue affects Akismet htaccess writer: from n/a through <= 1.0.1.

  Product

  Akismet htaccess writer

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Akismet htaccess writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Edwiser Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49311 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Stored XSS.This issue affects Edwiser Bridge: from n/a through <= 3.0.7.

  Product

  Edwiser Bridge

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.0.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Digitally: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49309 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omarfolghe Digitally digitally allows Reflected XSS.This issue affects Digitally: from n/a through <= 1.0.8.

  Product

  Digitally

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Digitally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Animator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49308 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows Reflected XSS.This issue affects Animator: from n/a through <= 3.0.15.

  Product

  Animator

  Affected

  up to 3.0.15

  What to do

  Affects up to 3.0.15. Update Animator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Admin Management Xtended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49307 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Stored XSS.This issue affects Admin Management Xtended : from n/a through <= 2.4.6.

  Product

  Admin Management Xtended

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024WordPress Portfolio Builder – Portfolio Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49302 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through <= 1.1.7.

  Product

  WordPress Portfolio Builder – Portfolio Gallery

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024G Meta Keywords: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49301 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sinan Yorulmaz G Meta Keywords g-meta-keywords allows Stored XSS.This issue affects G Meta Keywords: from n/a through <= 1.4.

  Product

  G Meta Keywords

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update G Meta Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024PeproDev Ultimate Invoice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49298 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice pepro-ultimate-invoice allows Stored XSS.This issue affects PeproDev Ultimate Invoice: from n/a through <= 2.0.6.

  Product

  PeproDev Ultimate Invoice

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Custom Add to Cart Button Label and Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49296 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-cart-button allows Stored XSS.This issue affects Custom Add to Cart Button Label and Link: from n/a through <= 1.6.1.

  Product

  Custom Add to Cart Button Label and Link

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Custom Add to Cart Button Label and Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49295 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimonials-showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through <= 1.1.6.

  Product

  Simple Testimonials Showcase

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49292 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-for-elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through <= 2.7.1.

  Product

  Exclusive Addons Elementor

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Cooked Pro: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49289 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This issue affects Cooked Pro: from n/a before 1.8.0.

  Product

  Cooked Pro

  Fixed in

  1.8.0

  What to do

  Update Cooked Pro to 1.8.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Point Maker: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49317 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows PHP Local File Inclusion.This issue affects Point Maker: from n/a through <= 0.1.4.

  Product

  Point Maker

  Affected

  up to 0.1.4

  What to do

  Affects up to 0.1.4. Update Point Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Email Verification for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49305 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Email Verification for WooCommerce emails-verification-for-woocommerce allows SQL Injection.This issue affects Email Verification for WooCommerce: from n/a through <= 2.8.10.

  Product

  Email Verification for WooCommerce

  Affected

  up to 2.8.10

  What to do

  Affects up to 2.8.10. Update Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Surfer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49299 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Surfer Surfer surferseo allows SQL Injection.This issue affects Surfer: from n/a through <= 1.5.0.502.

  Product

  Surfer

  Affected

  up to 1.5.0.502

  What to do

  Affects up to 1.5.0.502. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.