Vulnerability database

9,260 results · page 131 of 186

• Nov 9, 2024Bing Search API Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51692 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in askewbrook Bing Search API Integration abbs-bing-search allows Reflected XSS.This issue affects Bing Search API Integration: from n/a through <= 0.3.3.

  Product

  Bing Search API Integration

  Affected

  up to 0.3.3

  What to do

  Affects up to 0.3.3. Update Bing Search API Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Admin Amplify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51691 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aryanduntley Admin Amplify wpr-admin-amplify allows Reflected XSS.This issue affects Admin Amplify: from n/a through <= 1.3.0.

  Product

  Admin Amplify

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Admin Amplify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Wp Slide Categorywise: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51690 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neelam.samariya Wp Slide Categorywise wp-slide-categorywise allows Reflected XSS.This issue affects Wp Slide Categorywise: from n/a through <= 1.1.

  Product

  Wp Slide Categorywise

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Wp Slide Categorywise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024CF7 WOW Styler: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-51689 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows Reflected XSS.This issue affects CF7 WOW Styler: from n/a through <= 1.6.8.

  Product

  CF7 WOW Styler

  Affected

  up to 1.6.8

  What to do

  Affects up to 1.6.8. Update CF7 WOW Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Delisho: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51676 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious Delisho dr-widgets-blocks allows DOM-Based XSS.This issue affects Delisho: from n/a through <= 1.0.6.

  Product

  Delisho

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Delisho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51675 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows DOM-Based XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.7.

  Product

  aThemes Addons for Elementor

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Sastra Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fast Themes Sastra Essential Addons for Elementor sastra-essential-addons-for-elementor allows DOM-Based XSS.This issue affects Sastra Essential Addons for Elementor: from n/a through <= 1.0.5.

  Product

  Sastra Essential Addons for Elementor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Sastra Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024HT Politic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51673 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Politic wp-politic allows DOM-Based XSS.This issue affects HT Politic: from n/a through <= 2.4.4.

  Product

  HT Politic

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update HT Politic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024JS Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51670 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through <= 2.8.7.

  Product

  JS Help Desk

  Affected

  up to 2.8.7

  What to do

  Affects up to 2.8.7. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024WPHelpful: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51761 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackgilbert WPHelpful wphelpful allows Stored XSS.This issue affects WPHelpful: from n/a through <= 1.2.4.

  Product

  WPHelpful

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update WPHelpful to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Dashing Memberships: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51760 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ristretto Apps Dashing Memberships dashing-memberships allows Reflected XSS.This issue affects Dashing Memberships: from n/a through <= 1.1.

  Product

  Dashing Memberships

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Dashing Memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024SVT Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detlef Beyer SVT Simple svt-simple allows Reflected XSS.This issue affects SVT Simple: from n/a through <= 1.0.1.

  Product

  SVT Simple

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update SVT Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Simplistic SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51719 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roman Peterhans Simplistic SEO simplistic-seo allows Reflected XSS.This issue affects Simplistic SEO: from n/a through <= 2.3.0.

  Product

  Simplistic SEO

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Simplistic SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Simple Modal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51718 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arsdehnel Simple Modal simplemodal allows Cross-Site Scripting (XSS).This issue affects Simple Modal: from n/a through <= 0.3.3.

  Product

  Simple Modal

  Affected

  up to 0.3.3

  What to do

  Affects up to 0.3.3. Update Simple Modal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Ajax Content Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51717 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perception System System Pvt. Ltd. Ajax Content Filter ajax-content-filter allows Reflected XSS.This issue affects Ajax Content Filter: from n/a through <= 1.0.

  Product

  Ajax Content Filter

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Ajax Content Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Twitter real time search scrolling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51716 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Twitter real time search scrolling twitter-real-time-search-scrolling allows Reflected XSS.This issue affects Twitter real time search scrolling: from n/a through <= 7.0.

  Product

  Twitter real time search scrolling

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update Twitter real time search scrolling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024User Password Reset: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51714 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techdabang User Password Reset user-password-reset allows Reflected XSS.This issue affects User Password Reset: from n/a through <= 1.0.

  Product

  User Password Reset

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update User Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024HQ60 Fidelity Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51713 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TRe Technology And Research S.r.l. HQ60 Fidelity Card hq60-fidelity-card allows Reflected XSS.This issue affects HQ60 Fidelity Card: from n/a through <= 1.8.

  Product

  HQ60 Fidelity Card

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update HQ60 Fidelity Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Jigoshop – Store Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51712 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Visser Jigoshop – Store Toolkit jigoshop-store-toolkit allows Reflected XSS.This issue affects Jigoshop – Store Toolkit: from n/a through <= 1.4.0.

  Product

  Jigoshop – Store Toolkit

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Jigoshop – Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Saragna: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51711 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Khunt Saragna saragna-social-stream allows Reflected XSS.This issue affects Saragna: from n/a through <= 1.0.

  Product

  Saragna

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Saragna to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Responsive Data Table: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51710 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minerva Infotech Responsive Data Table responsive-data-table allows Reflected XSS.This issue affects Responsive Data Table: from n/a through <= 1.3.

  Product

  Responsive Data Table

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Responsive Data Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024TeleAdmin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51709 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mariandz TeleAdmin teleadmin allows Reflected XSS.This issue affects TeleAdmin: from n/a through <= 1.0.0.

  Product

  TeleAdmin

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update TeleAdmin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Narnoo Commerce Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51708 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Narnoo Narnoo Commerce Manager narnoo-commerce-manager allows Reflected XSS.This issue affects Narnoo Commerce Manager: from n/a through <= 1.6.0.

  Product

  Narnoo Commerce Manager

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Narnoo Commerce Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024WP Visual Adverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51707 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodin WP Visual Adverts wp-visual-adverts allows Reflected XSS.This issue affects WP Visual Adverts: from n/a through <= 2.3.0.

  Product

  WP Visual Adverts

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update WP Visual Adverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Firework Shoppable Live Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51781 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan Backor Firework Shoppable Live Video firework-videos allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through <= 6.3.

  Product

  Firework Shoppable Live Video

  Affected

  up to 6.3

  What to do

  Affects up to 6.3. Update Firework Shoppable Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024eewee admin custom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51780 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eewee eewee admin custom eewee-admincustom allows Reflected XSS.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.

  Product

  eewee admin custom

  Affected

  up to 1.8.2.4

  What to do

  Affects up to 1.8.2.4. Update eewee admin custom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Don't Break The Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51779 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Coleman Don't Break The Code dont-break-the-code allows Reflected XSS.This issue affects Don't Break The Code: from n/a through <= .3.1.

  Product

  Don't Break The Code

  What to do

  Update Don't Break The Code to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Satisfaction Reports from Help Scout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51778 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tevya Satisfaction Reports from Help Scout happiness-reports-for-help-scout allows Reflected XSS.This issue affects Satisfaction Reports from Help Scout: from n/a through <= 2.0.3.

  Product

  Satisfaction Reports from Help Scout

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Satisfaction Reports from Help Scout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Daily Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51776 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Hotchkiss Daily Image daily-image allows Reflected XSS.This issue affects Daily Image: from n/a through <= 1.0.

  Product

  Daily Image

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Daily Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Team Showcase and Slider – Team Members Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51763 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biplob018 Team Showcase and Slider – Team Members Builder team-showcase-ultimate allows Reflected XSS.This issue affects Team Showcase and Slider – Team Members Builder: from n/a through <= 1.3.

  Product

  Team Showcase and Slider – Team Members Builder

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Team Showcase and Slider – Team Members Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024PropertyShift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51762 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Gipple PropertyShift propertyshift allows Reflected XSS.This issue affects PropertyShift: from n/a through <= 1.0.0.

  Product

  PropertyShift

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update PropertyShift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024RSVP ME: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50544 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.

  Product

  RSVP ME

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update RSVP ME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Lodgix.com Vacation Rental Website Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50539 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in lodgix Lodgix.com Vacation Rental Website Builder lodgixcom-vacation-rental-listing-management-booking-plugin allows SQL Injection.This issue affects Lodgix.com Vacation Rental Website Builder: from n/a through <= 3.9.73.

  Product

  Lodgix.com Vacation Rental Website Builder

  Affected

  up to 3.9.73

  What to do

  Affects up to 3.9.73. Update Lodgix.com Vacation Rental Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Administrator Z: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50524 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quý Lê 91 Administrator Z administrator-z allows Blind SQL Injection.This issue affects Administrator Z: from n/a through < 2024.10.21.

  Product

  Administrator Z

  What to do

  Update Administrator Z to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Conversion Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-10676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wojciechborowicz Conversion Helper conversion-helper allows Reflected XSS.This issue affects Conversion Helper: from n/a through <= 1.12.

  Product

  Conversion Helper

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update Conversion Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51787 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.3.

  Product

  ElementsReady Addons for Elementor

  Affected

  up to 6.4.3

  What to do

  Affects up to 6.4.3. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Realty by BestWebSoft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51786 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Realty by BestWebSoft realty allows Stored XSS.This issue affects Realty by BestWebSoft: from n/a through <= 1.1.5.

  Product

  Realty by BestWebSoft

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Realty by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024FriendStore for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51784 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VietFriend team FriendStore for WooCommerce friendstore-for-woocommerce allows Reflected XSS.This issue affects FriendStore for WooCommerce: from n/a through <= 1.4.2.

  Product

  FriendStore for WooCommerce

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update FriendStore for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Forms: 3rd-Party Post Again: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51783 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaus Forms: 3rd-Party Post Again forms-3rdparty-post-again allows Reflected XSS.This issue affects Forms: 3rd-Party Post Again: from n/a through <= 0.3.

  Product

  Forms: 3rd-Party Post Again

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Forms: 3rd-Party Post Again to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Loginplus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51782 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanjay Prasad Loginplus loginplus allows Stored XSS.This issue affects Loginplus: from n/a through <= 1.2.

  Product

  Loginplus

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Quran Shortcode: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51625 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in edckwt Quran Shortcode quran-shortcode allows Blind SQL Injection.This issue affects Quran Shortcode: from n/a through <= 1.5.

  Product

  Quran Shortcode

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Quran Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Download-Mirror-Counter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51621 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reza19 Download-Mirror-Counter wp-download-mirror-counter allows SQL Injection.This issue affects Download-Mirror-Counter: from n/a through <= 1.1.

  Product

  Download-Mirror-Counter

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Download-Mirror-Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Porsline: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51620 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in porsline Porsline porsline allows Blind SQL Injection.This issue affects Porsline: from n/a through <= 1.0.2.

  Product

  Porsline

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Porsline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Market 360 Viewer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51619 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in market360 Market 360 Viewer market-360-viewer allows Blind SQL Injection.This issue affects Market 360 Viewer: from n/a through <= 1.01.

  Product

  Market 360 Viewer

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update Market 360 Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Golf Tracker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51607 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in percent20 Golf Tracker golf-tracker allows SQL Injection.This issue affects Golf Tracker: from n/a through <= 0.7.

  Product

  Golf Tracker

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Golf Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Simple Job Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51602 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in oleksandr87 Simple Job Manager simple-job-manager allows SQL Injection.This issue affects Simple Job Manager: from n/a through <= 1.1.

  Product

  Simple Job Manager

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Website price calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51601 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Maksym Marko Website price calculator price-calculator-to-your-website allows SQL Injection.This issue affects Website price calculator: from n/a through <= 4.1.

  Product

  Website price calculator

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Website price calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 20245 Stars Rating Funnel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51579 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.4.01.

  Product

  5 Stars Rating Funnel

  Affected

  up to 1.4.01

  What to do

  Affects up to 1.4.01. Update 5 Stars Rating Funnel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Easy Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51570 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in odihost Easy Gallery simple-gallery-odihost allows SQL Injection.This issue affects Easy Gallery: from n/a through <= 1.4.

  Product

  Easy Gallery

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Easy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 8, 2024Simple Shortcode for Google Maps: Stored Cross-Site ScriptingCVE-2024-10621 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Simple Shortcode for Google Maps

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Simple Shortcode for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.