Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

355new WordPress flaws this week

393,576entries in the database

12,425 results · page 147 of 249

Dec 16, 2024Increase Sociability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54395 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preblogging Increase Sociability increase-sociability allows Reflected XSS.This issue affects Increase Sociability: from n/a through <= 1.3.0.
Product
Increase Sociability
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Increase Sociability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024TagGator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected XSS.This issue affects TagGator: from n/a through <= 1.54.
Product
TagGator
Affected
up to 1.54
What to do
Affects up to 1.54. Update TagGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Posts Date Ranges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54387 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaytesh Barange Posts Date Ranges posts-date-ranges allows Reflected XSS.This issue affects Posts Date Ranges: from n/a through <= 2.2.
Product
Posts Date Ranges
Affected
up to 2.2
What to do
Affects up to 2.2. Update Posts Date Ranges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Feedpress Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54364 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spartac Feedpress Generator feedpress-generator allows Reflected XSS.This issue affects Feedpress Generator: from n/a through <= 1.2.1.
Product
Feedpress Generator
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Feedpress Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Gutensee: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54360 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in premila Gutensee gutensee allows DOM-Based XSS.This issue affects Gutensee: from n/a through <= 1.0.6.
Product
Gutensee
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Gutensee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 20243D Avatar User Profile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through <= 1.0.0.
Product
3D Avatar User Profile
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update 3D Avatar User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2024Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2024-11720 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when lower-level users have been granted access to submit specific forms, which is disabled by default.
Product
Frontend Admin by DynamiApps
Affected
up to 3.24.5
What to do
Affects up to 3.24.5. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024bodi0`s Easy cache: Stored Cross-Site ScriptingCVE-2024-12628 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
bodi0`s Easy cache
Affected
up to 0.8
What to do
Affects up to 0.8. Update bodi0`s Easy cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org getastra.com
Dec 14, 2024Post to Pdf: Stored Cross-Site ScriptingCVE-2024-12446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post to Pdf
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post to Pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Simple Locator: Stored Cross-Site ScriptingCVE-2024-12501 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Locator
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Simple Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024GeoDataSource Country Region DropDown: Stored Cross-Site ScriptingCVE-2024-12474 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeoDataSource Country Region DropDown
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update GeoDataSource Country Region DropDown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Ganohrs Toggle Shortcode: Stored Cross-Site ScriptingCVE-2024-12459 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ganohrs Toggle Shortcode
Affected
up to 0.2.4
What to do
Affects up to 0.2.4. Update Ganohrs Toggle Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Import Eventbrite Events: Reflected Cross-Site ScriptingCVE-2024-12422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Import Eventbrite Events
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Import Eventbrite Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Eveeno: Stored Cross-Site ScriptingCVE-2024-11752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Eveeno
Affected
up to 1.7
What to do
Affects up to 1.7. Update Eveeno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-10646 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024States Map US: Stored Cross-Site ScriptingCVE-2024-12523 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
States Map US
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update States Map US to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024WooCommerce Cart Count Shortcode: Stored Cross-Site ScriptingCVE-2024-12517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WooCommerce Cart Count Shortcode
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WooCommerce Cart Count Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024My IDX Home Search: Stored Cross-Site ScriptingCVE-2024-12502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My IDX Home Search
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update My IDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Smart PopUp Blaster: Stored Cross-Site ScriptingCVE-2024-12458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart PopUp Blaster
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart PopUp Blaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024Posts and Products Views for WooCommerce: Stored Cross-Site ScriptingCVE-2024-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Posts and Products Views for WooCommerce
Affected
up to 2.1
What to do
Affects up to 2.1. Update Posts and Products Views for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More: Stored Cross-Site ScriptingCVE-2024-12411 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024The Permalinker: Stored Cross-Site ScriptingCVE-2024-11894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Permalinker
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update The Permalinker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024My IDX Home Search: Stored Cross-Site ScriptingCVE-2024-11889 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-search' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My IDX Home Search
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update My IDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024IDer Login for: Stored Cross-Site ScriptingCVE-2024-11888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IDer Login for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ider_login_button' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects version 2.1, but was also patched in version 2.1 - a new version was not released with the patch.
Product
IDer Login for
Affected
up to 2.1
What to do
Affects up to 2.1. Update IDer Login for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Wp photo text slider 50: Stored Cross-Site ScriptingCVE-2024-11884 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up to, and including, 8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wp photo text slider 50
Affected
up to 8.1
What to do
Affects up to 8.1. Update Wp photo text slider 50 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024Connatix Video Embed: Stored Cross-Site ScriptingCVE-2024-11883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnx_script_code' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Connatix Video Embed
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Connatix Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Cricket Live Score: Stored Cross-Site ScriptingCVE-2024-11877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cricket_score' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cricket Live Score
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Cricket Live Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site: Stored Cross-Site ScriptingCVE-2024-11876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kredeum_opensky' shortcode in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024glomex oEmbed: Stored Cross-Site ScriptingCVE-2024-11873 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glomex_integration' shortcode in all versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
glomex oEmbed
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update glomex oEmbed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Buk for: Stored Cross-Site ScriptingCVE-2024-11869 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Buk for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buk' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Buk for
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Buk for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Companion Portfolio – Responsive Portfolio: Stored Cross-Site ScriptingCVE-2024-11867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio' shortcode in all versions up to, and including, 2.4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Companion Portfolio – Responsive Portfolio
Affected
up to 2.4.0.1
What to do
Affects up to 2.4.0.1. Update Companion Portfolio – Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Tabs Maker: Stored Cross-Site ScriptingCVE-2024-11865 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on tab descriptions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tabs Maker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Tabs Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 14, 2024Koalendar – Events & Appointments Booking Calendar: Stored Cross-Site ScriptingCVE-2024-11855 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Koalendar – Events & Appointments Booking Calendar
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Koalendar – Events & Appointments Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Post Carousel & Slider: Stored Cross-Site ScriptingCVE-2024-11770 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Carousel & Slider
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Plezi: Stored Cross-Site ScriptingCVE-2024-11763 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Plezi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'plezi' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Plezi
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Plezi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Bukza: Stored Cross-Site ScriptingCVE-2024-11759 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bukza
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Bukza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024IMS Countdown: Stored Cross-Site ScriptingCVE-2024-11755 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
IMS Countdown
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update IMS Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024TCBD Popover: Stored Cross-Site ScriptingCVE-2024-11751 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TCBD Popover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd-popover-image ' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TCBD Popover
Affected
up to 1.2
What to do
Affects up to 1.2. Update TCBD Popover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Filestack Official: Reflected Cross-Site ScriptingCVE-2024-11462 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestack_options' parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Filestack Official
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Filestack Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Visualmodo Elements: Stored Cross-Site ScriptingCVE-2024-11095 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Visualmodo Elements
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Visualmodo Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 13, 2024Plain Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mashiurz Plain Post plain-post allows Stored XSS.This issue affects Plain Post: from n/a through <= 1.0.3.
Product
Plain Post
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Plain Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024FloristPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54347 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Reflected XSS.This issue affects FloristPress: from n/a through <= 7.2.0.
Product
FloristPress
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update FloristPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Barter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54346 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Barter barter allows DOM-Based XSS.This issue affects Barter: from n/a through <= 1.6.
Product
Barter
Affected
up to 1.6
What to do
Affects up to 1.6. Update Barter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Bicycleshop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54345 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Bicycleshop bicycleshop allows DOM-Based XSS.This issue affects Bicycleshop: from n/a through <= 1.5.
Product
Bicycleshop
Affected
up to 1.5
What to do
Affects up to 1.5. Update Bicycleshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Quick Shop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54344 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Quick Shop wp-quick-shop allows Reflected XSS.This issue affects WP Quick Shop: from n/a through <= 1.3.1.
Product
WP Quick Shop
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP Quick Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Connect Contact Form 7 to Constant Contact: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54343 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehowarde Connect Contact Form 7 to Constant Contact connect-contact-form-7-to-constant-contact-v3 allows Reflected XSS.This issue affects Connect Contact Form 7 to Constant Contact: from n/a through <= 1.4.
Product
Connect Contact Form 7 to Constant Contact
Affected
up to 1.4
What to do
Affects up to 1.4. Update Connect Contact Form 7 to Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024STAGGS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in STAGGS STAGGS staggs allows Reflected XSS.This issue affects STAGGS: from n/a through <= 2.0.0.
Product
STAGGS
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update STAGGS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024LabelGrid Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LabelGrid LabelGrid Tools label-grid-tools allows Reflected XSS.This issue affects LabelGrid Tools: from n/a through <= 1.3.58.
Product
LabelGrid Tools
Affected
up to 1.3.58
What to do
Affects up to 1.3.58. Update LabelGrid Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Simple Presenter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54340 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sylviavanos Simple Presenter simple-presenter allows Reflected XSS.This issue affects Simple Presenter: from n/a through <= 1.5.1.
Product
Simple Presenter
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Simple Presenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024geoFlickr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54339 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jbd7 geoFlickr geoflickr allows Reflected XSS.This issue affects geoFlickr: from n/a through <= 1.3.
Product
geoFlickr
Affected
up to 1.3
What to do
Affects up to 1.3. Update geoFlickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.