Vulnerability database

8,937 results · page 135 of 179

• Sep 17, 2024Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43938 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.29.0.

  Product

  Name Directory

  Affected

  up to 1.29.0

  What to do

  Affects up to 1.29.0. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024PropertyHive: Cross-Site Request ForgeryCVE-2024-8490 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  PropertyHive

  Affected

  up to 2.0.19

  What to do

  Affects up to 2.0.19. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 15, 2024Custom Query Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44059 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.3.1.

  Product

  Custom Query Blocks

  Affected

  up to 5.3.1

  What to do

  Affects up to 5.3.1. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Parabola: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44058 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Parabola allows Stored XSS.This issue affects Parabola: from n/a through 2.4.1.

  Product

  Parabola

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Parabola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Nirvana: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44057 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Nirvana allows Stored XSS.This issue affects Nirvana: from n/a through 1.6.3.

  Product

  Nirvana

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Nirvana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Mantra: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44056 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Mantra allows Stored XSS.This issue affects Mantra: from n/a through 3.3.2.

  Product

  Mantra

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Mantra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Fluida: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44054 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issue affects Fluida: from n/a through 1.8.8.

  Product

  Fluida

  Affected

  up to 1.8.8

  What to do

  Affects up to 1.8.8. Update Fluida to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Opor Ayam: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44053 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This issue affects Opor Ayam: from n/a through 1.8.

  Product

  Opor Ayam

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Opor Ayam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Flipping Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45460 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manu225 Flipping Cards flipping-cards allows Stored XSS.This issue affects Flipping Cards: from n/a through <= 1.30.

  Product

  Flipping Cards

  Affected

  up to 1.30

  What to do

  Affects up to 1.30. Update Flipping Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Product Slider for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45459 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Reflected XSS.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.50.

  Product

  Product Slider for WooCommerce

  Affected

  up to 1.13.50

  What to do

  Affects up to 1.13.50. Update Product Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45458 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.

  Product

  Spiffy Calendar

  Affected

  up to 4.9.13

  What to do

  Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45457 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.

  Product

  Spiffy Calendar

  Affected

  up to 4.9.13

  What to do

  Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45456 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.

  Product

  WP Meta SEO

  Affected

  up to 4.5.13

  What to do

  Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45455 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.

  Product

  WP Meta SEO

  Affected

  up to 4.5.13

  What to do

  Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Happyforms: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.

  Product

  Happyforms

  Affected

  up to 1.26.0

  What to do

  Affects up to 1.26.0. Update Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Custom Field Template: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44062 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.

  Product

  Custom Field Template

  Affected

  up to 2.6.5

  What to do

  Affects up to 2.6.5. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 15, 2024Filmix: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44060 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1.

  Product

  Filmix

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Filmix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 13, 2024AI Engine: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-6723 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.

  Product

  AI Engine

  Fixed in

  2.4.8

  What to do

  Update AI Engine to 2.4.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 12, 2024Easy Property Listings: Does not have CSRF checkCVE-2024-3163 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

  Product

  Easy Property Listings

  Fixed in

  3.5.4

  What to do

  Update Easy Property Listings to 3.5.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

  Product

  Opti Marketing

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

  Product

  TrueBooker

  Fixed in

  1.0.3

  What to do

  Update TrueBooker to 1.0.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 6, 2024WP ULike: Does not properly sanitize user display namesCVE-2024-6792 · WordPress plugins & themes · reported by WPScanLow 3.5

  The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.

  Product

  WP ULike

  Fixed in

  4.7.2.1

  What to do

  Update WP ULike to 4.7.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 4, 2024Sensei LMS: Does not properly protect some its REST API routesCVE-2024-7786 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.

  Product

  Sensei LMS

  Fixed in

  4.24.2

  What to do

  Update Sensei LMS to 4.24.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 4, 2024Viral Signup: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6926 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

  Product

  Viral Signup

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Viral Signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 29, 2024Magic Post Thumbnail: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43921 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9.

  Product

  Magic Post Thumbnail

  Affected

  up to 5.2.9

  What to do

  Affects up to 5.2.9. Update Magic Post Thumbnail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Gutenverse: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue affects Gutenverse: from n/a through 1.9.4.

  Product

  Gutenverse

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024DSGVO All in one for WP: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43964 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a through 4.5.

  Product

  DSGVO All in one for WP

  Affected

  up to 4.5

  What to do

  Affects up to 4.5. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024YellowPencil Visual CSS Style Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43963 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through 7.6.1.

  Product

  YellowPencil Visual CSS Style Editor

  Affected

  up to 7.6.1

  What to do

  Affects up to 7.6.1. Update YellowPencil Visual CSS Style Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024azurecurve Toggle Show/Hide: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43961 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stored XSS.This issue affects azurecurve Toggle Show/Hide: from n/a through 2.1.3.

  Product

  azurecurve Toggle Show/Hide

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update azurecurve Toggle Show/Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Web and WooCommerce Addons for WPBakery Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43960 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Page Builder Addons Web and WooCommerce Addons for WPBakery Builder allows Stored XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through 1.4.6.

  Product

  Web and WooCommerce Addons for WPBakery Builder

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Web and WooCommerce Addons for WPBakery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024IntoTheDark: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43958 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This issue affects IntoTheDark: from n/a through 1.0.5.

  Product

  IntoTheDark

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update IntoTheDark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Classic Addons – WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43953 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows Stored XSS.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.5.

  Product

  Classic Addons – WPBakery Page Builder

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Esotera: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43952 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Esotera allows Stored XSS.This issue affects Esotera: from n/a through 1.2.5.1.

  Product

  Esotera

  Affected

  up to 1.2.5.1

  What to do

  Affects up to 1.2.5.1. Update Esotera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Tempera: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43951 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Tempera allows Stored XSS.This issue affects Tempera: from n/a through 1.8.2.

  Product

  Tempera

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update Tempera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Brickscore: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43950 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nextbricks Brickscore allows Stored XSS.This issue affects Brickscore: from n/a through 1.4.2.5.

  Product

  Brickscore

  Affected

  up to 1.4.2.5

  What to do

  Affects up to 1.4.2.5. Update Brickscore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024GHActivity: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43949 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha.

  Product

  GHActivity

  Affected

  up to 2.0.0-alpha

  What to do

  Affects up to 2.0.0-alpha. Update GHActivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024WP Armour Extended: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43948 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.

  Product

  WP Armour Extended

  Affected

  up to 1.26

  What to do

  Affects up to 1.26. Update WP Armour Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024SKT Blocks – Gutenberg based Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43946 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Blocks – Gutenberg based Page Builder allows Stored XSS.This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 1.5.

  Product

  SKT Blocks – Gutenberg based Page Builder

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SKT Blocks – Gutenberg based Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024EmbedPress: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43936 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper EmbedPress allows Stored XSS.This issue affects EmbedPress: from n/a through 4.0.8.

  Product

  EmbedPress

  Affected

  up to 4.0.8

  What to do

  Affects up to 4.0.8. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Delicious Recipes – WordPress Recipe: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43935 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes – WordPress Recipe Plugin allows Stored XSS.This issue affects Delicious Recipes – WordPress Recipe Plugin: from n/a through 1.6.7.

  Product

  Delicious Recipes – WordPress Recipe

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Delicious Recipes – WordPress Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Collapsing Archives: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43934 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Robert Felty Collapsing Archives allows Stored XSS.This issue affects Collapsing Archives: from n/a through 3.0.5.

  Product

  Collapsing Archives

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Beaver Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43926 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Reflected XSS.This issue affects Beaver Builder: from n/a through 2.8.3.2.

  Product

  Beaver Builder

  Affected

  up to 2.8.3.2

  What to do

  Affects up to 2.8.3.2. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024SendGrid for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43965 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.

  Product

  SendGrid for

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SendGrid for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Animated Number Counters: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43957 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File Inclusion.This issue affects Animated Number Counters: from n/a through 1.9.

  Product

  Animated Number Counters

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Animated Number Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Droip: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43955 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.

  Product

  Droip

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Greenshift Woocommerce Addon: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43943 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Woocommerce Addon allows SQL Injection.This issue affects Greenshift Woocommerce Addon: from n/a before 1.9.8.

  Product

  Greenshift Woocommerce Addon

  Fixed in

  1.9.8

  What to do

  Update Greenshift Woocommerce Addon to 1.9.8 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Greenshift Query and Meta Addon: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43942 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Query and Meta Addon allows SQL Injection.This issue affects Greenshift Query and Meta Addon: from n/a before 3.9.2.

  Product

  Greenshift Query and Meta Addon

  Fixed in

  3.9.2

  What to do

  Update Greenshift Query and Meta Addon to 3.9.2 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024Propovoice Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43941 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue affects Propovoice Pro: from n/a through 1.7.0.3.

  Product

  Propovoice Pro

  Affected

  up to 1.7.0.3

  What to do

  Affects up to 1.7.0.3. Update Propovoice Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024NitroPack: Improper Control of Generation of Code ('Code Injection')CVE-2024-43922 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/a through 1.16.7.

  Product

  NitroPack

  Affected

  up to 1.16.7

  What to do

  Affects up to 1.16.7. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2024WBW Product Table PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43918 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through 1.9.4.

  Product

  WBW Product Table PRO

  Affected

  up to 1.9.4

  What to do

  Affects up to 1.9.4. Update WBW Product Table PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.