Vulnerability database

9,260 results · page 132 of 186

• Nov 5, 2024Seriously Simple Podcasting: Reflected Cross-Site ScriptingCVE-2024-9667 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Seriously Simple Podcasting

  Affected

  up to 3.5.0

  What to do

  Affects up to 3.5.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Notification settingsCVE-2024-7877 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

  Product

  Appointment Booking Calendar — Simply Schedule Appointments Booking

  Fixed in

  1.6.7.55

  What to do

  Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.

  Full record and what to do →NVD recordwpscan.com

• Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Appointment Type settingsCVE-2024-7876 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

  Product

  Appointment Booking Calendar — Simply Schedule Appointments Booking

  Fixed in

  1.6.7.55

  What to do

  Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.

  Full record and what to do →NVD recordwpscan.com

• Nov 4, 2024Accordion title for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-51685 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Gangolf Accordion title for Elementor allows Stored XSS.This issue affects Accordion title for Elementor: from n/a through 1.2.1.

  Product

  Accordion title for Elementor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Accordion title for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024Custom post type templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51683 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Custom post type templates for Elementor custom-post-type-templates-for-elementor allows Stored XSS.This issue affects Custom post type templates for Elementor: from n/a through <= 1.10.1.

  Product

  Custom post type templates for Elementor

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update Custom post type templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024HT Builder – WordPress Theme Builder for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51682 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Builder – WordPress Theme Builder for Elementor ht-builder allows Stored XSS.This issue affects HT Builder – WordPress Theme Builder for Elementor: from n/a through <= 1.3.0.

  Product

  HT Builder – WordPress Theme Builder for Elementor

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update HT Builder – WordPress Theme Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024WP Pocket URLs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51681 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs wp-pocket-urls allows Stored XSS.This issue affects WP Pocket URLs: from n/a through <= 1.0.3.

  Product

  WP Pocket URLs

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update WP Pocket URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024Cresta Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51680 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Cresta Addons for Elementor cresta-addons-for-elementor allows Stored XSS.This issue affects Cresta Addons for Elementor: from n/a through <= 1.0.9.

  Product

  Cresta Addons for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Cresta Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024Elo Rating Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51678 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through <= 1.0.3.

  Product

  Elo Rating Shortcode

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Elo Rating Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024Knowledge Base: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51677 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Knowledge Base knowledgebase allows Stored XSS.This issue affects Knowledge Base: from n/a through <= 2.2.0.

  Product

  Knowledge Base

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024Woocommerce Quote Calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51626 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.

  Product

  Woocommerce Quote Calculator

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Woocommerce Quote Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024BetterLinks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51672 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper BetterLinks betterlinks allows SQL Injection.This issue affects BetterLinks: from n/a through <= 2.1.7.

  Product

  BetterLinks

  Affected

  up to 2.1.7

  What to do

  Affects up to 2.1.7. Update BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 4, 2024Media LIbrary Assistant: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-51661 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.

  Product

  Media LIbrary Assistant

  Affected

  up to 3.19

  What to do

  Affects up to 3.19. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 1, 2024MailChimp Subscribe Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43211 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms allows Stored XSS.This issue affects MailChimp Subscribe Forms : from n/a through 4.0.9.9.

  Product

  MailChimp Subscribe Forms

  Affected

  up to 4.0.9.9

  What to do

  Affects up to 4.0.9.9. Update MailChimp Subscribe Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 1, 2024Meks Video Importer: Missing AuthorizationCVE-2024-38733 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Meks Meks Video Importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meks Video Importer: from n/a through 1.0.12.

  Product

  Meks Video Importer

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update Meks Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 1, 2024Newspack Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37423 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.

  Product

  Newspack Blocks

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 1, 2024WishList Member X: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37108 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.

  Product

  WishList Member X

  Affected

  up to 3.26.6

  What to do

  Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 31, 2024WPMobile.App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43933 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This issue affects WPMobile.App: from n/a through <= 11.48.

  Product

  WPMobile.App

  Affected

  up to 11.48

  What to do

  Affects up to 11.48. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 31, 2024WP Simple Anchors Links: Stored Cross-Site ScriptingCVE-2024-9446 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WP Simple Anchors Links

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Simple Anchors Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50509 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

  Product

  Woocommerce Product Design

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50508 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

  Product

  Woocommerce Product Design

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024BP Member Type Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager allows Reflected XSS.This issue affects BP Member Type Manager: from n/a through <= 1.01.

  Product

  BP Member Type Manager

  Affected

  up to 1.01

  What to do

  Affects up to 1.01. Update BP Member Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024CWD 3D Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery allows Reflection Injection.This issue affects CWD 3D Image Gallery: from n/a through <= 1.0.

  Product

  CWD 3D Image Gallery

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update CWD 3D Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WP ERP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP ERP erp allows Reflected XSS.This issue affects WP ERP: from n/a through <= 1.13.2.

  Product

  WP ERP

  Affected

  up to 1.13.2

  What to do

  Affects up to 1.13.2. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Affiliate Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49645 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilias Gomatos Affiliate Platform smdp-affiliate-platform allows Reflected XSS.This issue affects Affiliate Platform: from n/a through <= 1.4.8.

  Product

  Affiliate Platform

  Affected

  up to 1.4.8

  What to do

  Affects up to 1.4.8. Update Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Whitelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment Whitelist fifthsegment-whitelist allows Reflected XSS.This issue affects Whitelist: from n/a through <= 3.5.

  Product

  Whitelist

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update Whitelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Tida URL Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49641 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tidaweb Tida URL Screenshot tida-url-screenshot allows Reflected XSS.This issue affects Tida URL Screenshot: from n/a through <= 1.0.1.

  Product

  Tida URL Screenshot

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Tida URL Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024ACL Floating Cart for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmaderCode Lab ACL Floating Cart for WooCommerce acl-floating-cart-for-woocommerce allows Reflected XSS.This issue affects ACL Floating Cart for WooCommerce: from n/a through <= 0.9.

  Product

  ACL Floating Cart for WooCommerce

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update ACL Floating Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Monitor.chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Stoever Monitor.chat monitor-chat allows Reflected XSS.This issue affects Monitor.chat: from n/a through <= 1.1.1.

  Product

  Monitor.chat

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Monitor.chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Risk Warning Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ventureharbour Risk Warning Bar risk-warning-bar allows Reflected XSS.This issue affects Risk Warning Bar: from n/a through <= 1.0.

  Product

  Risk Warning Bar

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Risk Warning Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Bet WC 2018 Russia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Bet WC 2018 Russia bet-wc-2018-russia allows Reflected XSS.This issue affects Bet WC 2018 Russia: from n/a through <= 2.1.

  Product

  Bet WC 2018 Russia

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Bet WC 2018 Russia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Agile Video Player Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woracal Agile Video Player Lite agile-video-player allows Reflected XSS.This issue affects Agile Video Player Lite: from n/a through <= 1.0.

  Product

  Agile Video Player Lite

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Agile Video Player Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Banner Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manjurul.cis Banner Slider banner-slider allows Reflected XSS.This issue affects Banner Slider: from n/a through <= 2.1.

  Product

  Banner Slider

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Local Business Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49667 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asaduzzaman Abir Local Business Addons For Elementor map-addons-for-elementor-waze-map allows Stored XSS.This issue affects Local Business Addons For Elementor: from n/a through <= 1.1.5.

  Product

  Local Business Addons For Elementor

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Local Business Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Web Bricks Addons for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49665 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web Bricks Web Bricks Addons for Elementor allows Stored XSS.This issue affects Web Bricks Addons for Elementor: from n/a through 1.1.1.

  Product

  Web Bricks Addons for Elementor

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Web Bricks Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024chatplusjp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49664 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chatplusjp chatplusjp chatplusjp allows Reflected XSS.This issue affects chatplusjp: from n/a through <= 1.02.

  Product

  chatplusjp

  Affected

  up to 1.02

  What to do

  Affects up to 1.02. Update chatplusjp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024uCAT – Next Story: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49663 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elenkadark uCAT – Next Story ucat-next-story allows Reflected XSS.This issue affects uCAT – Next Story: from n/a through <= 2.0.0.

  Product

  uCAT – Next Story

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update uCAT – Next Story to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Simple Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49662 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webgensis Simple Load More simple-load-more allows Reflected XSS.This issue affects Simple Load More: from n/a through <= 1.0.

  Product

  Simple Load More

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024leenk.me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49661 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lew Ayotte leenk.me leenkme allows Reflected XSS.This issue affects leenk.me: from n/a through <= 2.16.0.

  Product

  leenk.me

  Affected

  up to 2.16.0

  What to do

  Affects up to 2.16.0. Update leenk.me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Campus Explorer Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49660 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CampusExplorer Campus Explorer Widget campus-explorer-widget allows Reflected XSS.This issue affects Campus Explorer Widget: from n/a through <= 1.4.

  Product

  Campus Explorer Widget

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Campus Explorer Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Coub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coub Coub coub allows DOM-Based XSS.This issue affects Coub: from n/a through <= 1.4.

  Product

  Coub

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Coub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024DocumentPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49656 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment DocumentPress documentpress-display-any-document-on-your-site allows Reflected XSS.This issue affects DocumentPress: from n/a through <= 2.1.

  Product

  DocumentPress

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update DocumentPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Extra Privacy for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49654 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marian Heddesheimer Extra Privacy for Elementor extra-privacy-for-elementor allows Reflected XSS.This issue affects Extra Privacy for Elementor: from n/a through <= 0.1.3.

  Product

  Extra Privacy for Elementor

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Extra Privacy for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WooCommerce Maintenance Mode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49651 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Royal WooCommerce Maintenance Mode woocommerce-maintenance-mode allows Reflected XSS.This issue affects WooCommerce Maintenance Mode: from n/a through <= 2.0.1.

  Product

  WooCommerce Maintenance Mode

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WooCommerce Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024BuddyPress Greeting Message: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49650 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xarbo BuddyPress Greeting Message bp-greeting-message allows Reflected XSS.This issue affects BuddyPress Greeting Message: from n/a through <= 1.0.3.

  Product

  BuddyPress Greeting Message

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update BuddyPress Greeting Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024SVG Captcha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49648 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi SVG Captcha svg-captcha allows Reflected XSS.This issue affects SVG Captcha: from n/a through <= 1.0.11.

  Product

  SVG Captcha

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update SVG Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Simple Custom Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49647 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin simple-custom-admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through <= 1.2.

  Product

  Simple Custom Admin

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Simple Custom Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Code Generate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ioannup Code Generate code-generator allows Reflected XSS.This issue affects Code Generate: from n/a through <= 1.0.

  Product

  Code Generate

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Code Generate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Namaste! LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50410 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.4.

  Product

  Namaste! LMS

  Affected

  up to 2.6.4

  What to do

  Affects up to 2.6.4. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Namaste! LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50409 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

  Product

  Namaste! LMS

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.