Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

456new WordPress flaws this week

393,009entries in the database

9,263 results · page 150 of 186

Jun 8, 202412 Step Meeting List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35693 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list.This issue affects 12 Step Meeting List: from n/a through <= 3.14.33.
Product
12 Step Meeting List
Affected
up to 3.14.33
What to do
Affects up to 3.14.33. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.9.
Product
Master Addons for Elementor
Affected
up to 2.0.5.9
What to do
Affects up to 2.0.5.9. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Link Library: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35687 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.3.
Product
Link Library
Affected
up to 7.6.3
What to do
Affects up to 7.6.3. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024wpDiscuz: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35681 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.18.
Product
wpDiscuz
Affected
up to 7.6.18
What to do
Affects up to 7.6.18. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35679 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.12.0.
Product
GiveWP
Affected
up to 3.12.0
What to do
Affects up to 3.12.0. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Sensei Pro (WC Paid Courses): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34765 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sensei Sensei Pro (WC Paid Courses) allows Stored XSS.This issue affects Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.
Product
Sensei Pro (WC Paid Courses)
Affected
up to 4.23.1.1.23.1
What to do
Affects up to 4.23.1.1.23.1. Update Sensei Pro (WC Paid Courses) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024RestroPress: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35719 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issue affects RestroPress: from n/a through 3.1.2.1.
Product
RestroPress
Affected
up to 3.1.2.1
What to do
Affects up to 3.1.2.1. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Newsletters: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.5.
Product
Newsletters
Affected
up to 4.9.5
What to do
Affects up to 4.9.5. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Bloglo: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35715 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in peregrinethemes Bloglo, peregrinethemes Blogvi allows Stored XSS.This issue affects Bloglo: from n/a through 1.1.3; Blogvi: from n/a through 1.0.5.
Product
Bloglo
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Bloglo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Idyllic: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35714 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Idyllic allows Stored XSS.This issue affects Idyllic: from n/a through 1.1.8.
Product
Idyllic
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Idyllic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Testimonial Carousel For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35713 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UAPP GROUP Testimonial Carousel For Elementor allows Stored XSS.This issue affects Testimonial Carousel For Elementor: from n/a through 10.1.1.
Product
Testimonial Carousel For Elementor
Affected
up to 10.1.1
What to do
Affects up to 10.1.1. Update Testimonial Carousel For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Event: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35711 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Event allows Stored XSS.This issue affects Event: from n/a through 1.2.2.
Product
Event
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.5.4.
Product
The Plus Addons for Elementor Page Builder Lite
Affected
up to 5.5.4
What to do
Affects up to 5.5.4. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Rife Free: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35708 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in apollo13themes Rife Free allows Stored XSS.This issue affects Rife Free: from n/a through 2.4.19.
Product
Rife Free
Affected
up to 2.4.19
What to do
Affects up to 2.4.19. Update Rife Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Heateor Social Login: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35707 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XSS.This issue affects Heateor Social Login: from n/a through 1.1.32.
Product
Heateor Social Login
Affected
up to 1.1.32
What to do
Affects up to 1.1.32. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Stellissimo Text Box: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35752 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Enea Overclokk Stellissimo Text Box allows Stored XSS.This issue affects Stellissimo Text Box: from n/a through 1.1.4.
Product
Stellissimo Text Box
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Stellissimo Text Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Woody ad snippets: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35751 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10.
Product
Woody ad snippets
Affected
up to 2.4.10
What to do
Affects up to 2.4.10. Update Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Responsive Image Gallery, Gallery Album: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-35750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Pixgraphy: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35740 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Pixgraphy allows Stored XSS.This issue affects Pixgraphy: from n/a through 1.3.8.
Product
Pixgraphy
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Pixgraphy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024The Post Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.1.
Product
The Post Grid
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Kognetiks Chatbot for: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for WordPress allows Stored XSS.This issue affects Kognetiks Chatbot for WordPress: from n/a through 1.9.8.
Product
Kognetiks Chatbot for
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024WP Visitors Tracker: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35737 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3.
Product
WP Visitors Tracker
Affected
up to 2.3
What to do
Affects up to 2.3. Update WP Visitors Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Visualizer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-35736 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from n/a through 3.11.1.
Product
Visualizer
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024WP Time Slots Booking Form: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.This issue affects WP Time Slots Booking Form: from n/a through 1.2.10.
Product
WP Time Slots Booking Form
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Auto Coupons for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RLDD Auto Coupons for WooCommerce allows Reflected XSS.This issue affects Auto Coupons for WooCommerce: from n/a through 3.0.14.
Product
Auto Coupons for WooCommerce
Affected
up to 3.0.14
What to do
Affects up to 3.0.14. Update Auto Coupons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024YITH Custom Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35732 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH Custom Login yith-custom-login.This issue affects YITH Custom Login: from n/a through <= 1.7.0.
Product
YITH Custom Login
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update YITH Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor allows Stored XSS.This issue affects Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor: from n/a through 1.3.9.
Product
Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Active Products Tables for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35730 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce allows Reflected XSS.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.3.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.6.3
What to do
Affects up to 1.0.6.3. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Tooltip CK: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35756 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.This issue affects Tooltip CK: from n/a through 2.2.15.
Product
Tooltip CK
Affected
up to 2.2.15
What to do
Affects up to 2.2.15. Update Tooltip CK to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Weather Widget Pro: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in El tiempo Weather Widget Pro allows Stored XSS.This issue affects Weather Widget Pro: from n/a through 1.1.40.
Product
Weather Widget Pro
Affected
up to 1.1.40
What to do
Affects up to 1.1.40. Update Weather Widget Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024TemplatesNext OnePager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35753 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemplatesNext TemplatesNext OnePager allows Stored XSS.This issue affects TemplatesNext OnePager: from n/a through 1.3.3.
Product
TemplatesNext OnePager
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update TemplatesNext OnePager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 6, 2024Clever Fox – One Click Website Importer by Nayra: Unauthorized modification of dataCVE-2023-6876 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site.
Product
Clever Fox – One Click Website Importer by Nayra
Affected
up to 25.2.0
What to do
Affects up to 25.2.0. Update Clever Fox – One Click Website Importer by Nayra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing: Unauthorized modification of dataCVE-2024-5449 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Simple Image Popup Shortcode: Stored Cross-Site ScriptingCVE-2024-5342 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Image Popup Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Image Popup Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 5, 2024Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'impoCVE-2024-5324 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Picture Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34759 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VideoWhisper Picture Gallery allows Stored XSS.This issue affects Picture Gallery: from n/a through 1.5.11.
Product
Picture Gallery
Affected
up to 1.5.11
What to do
Affects up to 1.5.11. Update Picture Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Easy Forms for Mailchimp: Insertion of Sensitive Information into Log FileCVE-2024-25095 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35653 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.8.0.
Product
Visual Composer Website Builder
Affected
up to 45.8.0
What to do
Affects up to 45.8.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Event Tickets with Ticket Scanner: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saso Nikolov Event Tickets with Ticket Scanner allows Reflected XSS.This issue affects Event Tickets with Ticket Scanner: from n/a through 2.3.1.
Product
Event Tickets with Ticket Scanner
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Flow Plus: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This issue affects WP Flow Plus: from n/a through 5.2.2.
Product
WP Flow Plus
Affected
up to 5.2.2
What to do
Affects up to 5.2.2. Update WP Flow Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Save as PDF plugin by Pdfcrowd: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.3.
Product
Save as PDF plugin by Pdfcrowd
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Cowidgets – Elementor Addons: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35782 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Codeless Cowidgets – Elementor Addons allows Stored XSS.This issue affects Cowidgets – Elementor Addons: from n/a through 1.1.1.
Product
Cowidgets – Elementor Addons
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue allows Reflected XSS.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.77.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Affected
up to 3.1.77
What to do
Affects up to 3.1.77. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Themesflat Addons For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35666 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS.This issue affects Themesflat Addons For Elementor: from n/a through 2.1.2.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WPvivid Backup for MainWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpvividplugins WPvivid Backup for MainWP wpvivid-backup-mainwp allows Reflected XSS.This issue affects WPvivid Backup for MainWP: from n/a through <= 0.9.32.
Product
WPvivid Backup for MainWP
Affected
up to 0.9.32
What to do
Affects up to 0.9.32. Update WPvivid Backup for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Brave: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35655 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave brave-popup-builder allows DOM-Based XSS.This issue affects Brave: from n/a through <= 0.6.9.
Product
Brave
Affected
up to 0.6.9
What to do
Affects up to 0.6.9. Update Brave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Responsive: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive allows Stored XSS.This issue affects Responsive: from n/a through 5.0.3.
Product
Responsive
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Woocommerce – Recent Purchases: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35634 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wow-Company Woocommerce – Recent Purchases allows PHP Local File Inclusion.This issue affects Woocommerce – Recent Purchases: from n/a through 1.0.1.
Product
Woocommerce – Recent Purchases
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Woocommerce – Recent Purchases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Easy Digital Downloads – Recent Purchases: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-35629 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads – Recent Purchases: from n/a through 1.0.2.
Product
Easy Digital Downloads – Recent Purchases
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Digital Downloads – Recent Purchases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Dextaz Ping: Improper Neutralization of Special Elements used in a Command ('Command Injection')CVE-2024-34792 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in dexta Dextaz Ping allows Command Injection.This issue affects Dextaz Ping: from n/a through 0.65.
Product
Dextaz Ping
Affected
up to 0.65
What to do
Affects up to 0.65. Update Dextaz Ping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.