Vulnerability database

9,260 results · page 133 of 186

• Oct 29, 2024Namaste! LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50407 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

  Product

  Namaste! LMS

  Affected

  up to 2.6.2

  What to do

  Affects up to 2.6.2. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024AffiliateX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49692 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCenter AffiliateX affiliatex allows Stored XSS.This issue affects AffiliateX: from n/a through <= 1.2.9.

  Product

  AffiliateX

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update AffiliateX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49679 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.1.0.

  Product

  WPKoi Templates for Elementor

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024js paper: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7.

  Product

  js paper

  Affected

  up to 2.5.7

  What to do

  Affects up to 2.5.7. Update js paper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024LaTeX2HTML: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49673 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Van Abel LaTeX2HTML latex2html allows Reflected XSS.This issue affects LaTeX2HTML: from n/a through <= 2.5.4.

  Product

  LaTeX2HTML

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update LaTeX2HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Client Power Tools Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49670 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal client-power-tools allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through <= 1.9.0.

  Product

  Client Power Tools Portal

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update Client Power Tools Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Bstone Demo Importer: Incorrect Privilege AssignmentCVE-2024-50481 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Demo Importer: from n/a through <= 1.0.1.

  Product

  Bstone Demo Importer

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Bstone Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50426 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.0.2.

  Product

  Survey Maker

  Affected

  up to 5.0.2

  What to do

  Affects up to 5.0.2. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Time Slot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50418 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Time Slot Booking Time Slot timeslot allows DOM-Based XSS.This issue affects Time Slot: from n/a through <= 1.3.6.

  Product

  Time Slot

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Time Slot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Ads.txt & App-ads.txt Manager for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50415 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.

  Product

  Ads.txt & App-ads.txt Manager for

  Affected

  up to 1.1.7.1

  What to do

  Affects up to 1.1.7.1. Update Ads.txt & App-ads.txt Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Button contact VR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50414 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buttonizer Button contact VR button-contact-vr allows Stored XSS.This issue affects Button contact VR: from n/a through <= 4.7.9.1.

  Product

  Button contact VR

  Affected

  up to 4.7.9.1

  What to do

  Affects up to 4.7.9.1. Update Button contact VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Import and export users and customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50413 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through <= 1.27.5.

  Product

  Import and export users and customers

  Affected

  up to 1.27.5

  What to do

  Affects up to 1.27.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Conditional Fields for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50412 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Stored XSS.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.15.

  Product

  Conditional Fields for Contact Form 7

  Affected

  up to 2.4.15

  What to do

  Affects up to 2.4.15. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024WP Abstracts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50411 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.7.1.

  Product

  WP Abstracts

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2024Todo Custom Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49642 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through <= 3.0.4.

  Product

  Todo Custom Field

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Todo Custom Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Qode Essential Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50457 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qode Essential Addons qode-essential-addons.This issue affects Qode Essential Addons: from n/a through <= 1.6.3.

  Product

  Qode Essential Addons

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Qode Essential Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Clean Retina: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50436 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Clean Retina clean-retina.This issue affects Clean Retina: from n/a through <= 3.0.6.

  Product

  Clean Retina

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update Clean Retina to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Meta News: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50435 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through <= 1.1.7.

  Product

  Meta News

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Meta News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024NewsCard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50434 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse NewsCard newscard.This issue affects NewsCard: from n/a through <= 1.3.

  Product

  NewsCard

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update NewsCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50437 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.80.

  Product

  GeoDirectory

  Affected

  up to 2.3.80

  What to do

  Affects up to 2.3.80. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Sky Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50433 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons allows Cross-Site Scripting (XSS).This issue affects Sky Addons for Elementor: from n/a through <= 2.5.15.

  Product

  Sky Addons for Elementor

  Affected

  up to 2.5.15

  What to do

  Affects up to 2.5.15. Update Sky Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Post Grid and Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50432 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Cross-Site Scripting (XSS).This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.2.93.

  Product

  Post Grid and Gutenberg Blocks

  Affected

  up to 2.2.93

  What to do

  Affects up to 2.2.93. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Breeze: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50431 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affects Breeze: from n/a through <= 2.1.14.

  Product

  Breeze

  Affected

  up to 2.1.14

  What to do

  Affects up to 2.1.14. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Magazine Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50429 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows DOM-Based XSS.This issue affects Magazine Blocks: from n/a through <= 1.3.15.

  Product

  Magazine Blocks

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update Magazine Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Textboxes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50469 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through <= 0.1.3.1.

  Product

  Textboxes

  Affected

  up to 0.1.3.1

  What to do

  Affects up to 0.1.3.1. Update Textboxes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Raptor Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50468 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faceleg Raptor Editor wp-raptor allows DOM-Based XSS.This issue affects Raptor Editor: from n/a through <= 1.0.20.

  Product

  Raptor Editor

  Affected

  up to 1.0.20

  What to do

  Affects up to 1.0.20. Update Raptor Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Scrollbar by webxapp – Best vertical/horizontal scrollbars: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50467 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteengineai Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin scrollbar-by-webxapp allows Stored XSS.This issue affects Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin: from n/a through <= 1.3.0.

  Product

  Scrollbar by webxapp – Best vertical/horizontal scrollbars

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Scrollbar by webxapp – Best vertical/horizontal scrollbars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Kodex Posts likes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50464 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.

  Product

  Kodex Posts likes

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Kodex Posts likes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Interactive World Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50462 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive World Map interactive-world-map allows Stored XSS.This issue affects Interactive World Map: from n/a through <= 3.4.4.

  Product

  Interactive World Map

  Affected

  up to 3.4.4

  What to do

  Affects up to 3.4.4. Update Interactive World Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024EmbedPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50461 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper EmbedPress embedpress allows Stored XSS.This issue affects EmbedPress: from n/a through <= 4.0.14.

  Product

  EmbedPress

  Affected

  up to 4.0.14

  What to do

  Affects up to 4.0.14. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Firelight Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50460 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <= 2.3.3.

  Product

  Firelight Lightbox

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Firelight Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50458 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.4.

  Product

  Advanced Sermons

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024MDTF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50451 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.4.

  Product

  MDTF

  Affected

  up to 1.3.3.4

  What to do

  Affects up to 1.3.3.4. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024PDF Generator Addon for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50449 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 1.7.4.

  Product

  PDF Generator Addon for Elementor Page Builder

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024YITH WooCommerce Product Add-Ons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50448 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.14.1.

  Product

  YITH WooCommerce Product Add-Ons

  Affected

  up to 4.14.1

  What to do

  Affects up to 4.14.1. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Envo's Elementor Templates & Widgets for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50447 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce envo-elementor-for-woocommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through <= 1.4.19.

  Product

  Envo's Elementor Templates & Widgets for WooCommerce

  Affected

  up to 1.4.19

  What to do

  Affects up to 1.4.19. Update Envo's Elementor Templates & Widgets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50446 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra.This issue affects Futurio Extra: from n/a through <= 2.0.11.

  Product

  Futurio Extra

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Selection Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50445 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Selection Lite selection-lite allows Stored XSS.This issue affects Selection Lite: from n/a through <= 1.13.

  Product

  Selection Lite

  Affected

  up to 1.13

  What to do

  Affects up to 1.13. Update Selection Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50441 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.15.

  Product

  Cozy Blocks

  Affected

  up to 2.0.15

  What to do

  Affects up to 2.0.15. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024CodePen Embedded Pens Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50440 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode codepen-embedded-pen-shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through <= 1.0.2.

  Product

  CodePen Embedded Pens Shortcode

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update CodePen Embedded Pens Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Astra Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50439 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.14.

  Product

  Astra Widgets

  Affected

  up to 1.2.14

  What to do

  Affects up to 1.2.14. Update Astra Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Church Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0.

  Product

  Church Admin

  Fixed in

  5.0.0

  What to do

  Update Church Admin to 5.0.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50443 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.12.

  Product

  PostX

  Affected

  up to 4.1.12

  What to do

  Affects up to 4.1.12. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50502 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.18.

  Product

  Cozy Blocks

  Affected

  up to 2.0.18

  What to do

  Affects up to 2.0.18. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Kata Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50501 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through <= 1.4.7.

  Product

  Kata Plus

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Advanced Online Ordering and Delivery Platform: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50497 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and Delivery Platform advanced-online-ordering-and-delivery-platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through <= 2.0.0.

  Product

  Advanced Online Ordering and Delivery Platform

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Advanced Online Ordering and Delivery Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024RSVP ME: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50491 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.

  Product

  RSVP ME

  Affected

  up to 1.9.9

  What to do

  Affects up to 1.9.9. Update RSVP ME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Woocommerce Quote Calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50479 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.

  Product

  Woocommerce Quote Calculator

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Woocommerce Quote Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Amilia Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50472 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martindrapeau Amilia Store amilia-store allows Stored XSS.This issue affects Amilia Store: from n/a through <= 2.9.8.

  Product

  Amilia Store

  Affected

  up to 2.9.8

  What to do

  Affects up to 2.9.8. Update Amilia Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Trip Plan: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50471 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Trip Plan tripplan allows DOM-Based XSS.This issue affects Trip Plan: from n/a through <= 1.0.10.

  Product

  Trip Plan

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Trip Plan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.