Updated 32 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

359new WordPress flaws this week

393,576entries in the database

8,946 results · page 160 of 179

Mar 21, 2024WPFunnels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27965 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.
Product
WPFunnels
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Crisp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27963 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44.
Product
Crisp
Affected
up to 0.44
What to do
Affects up to 0.44. Update Crisp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024wp-mpdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian 'fkrauthan' Krauthan allows Reflected XSS.This issue affects wp-mpdf: from n/a through 3.7.1.
Product
wp-mpdf
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update wp-mpdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-27956 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
Product
Automatic
Affected
up to 3.92.0
What to do
Affects up to 3.92.0. Update Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024WP 2FA: Improper AuthenticationCVE-2022-44595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
Product
WP 2FA
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WP 2FA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27995 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: from n/a through 4.0.23.
Product
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Affected
up to 4.0.23
What to do
Affects up to 4.0.23. Update ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024YITH WooCommerce Product Add-Ons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27994 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.5.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Calendarista Basic Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
Product
Calendarista Basic Edition
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024HT Easy GA4 ( Google Analytics 4 ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7.
Product
HT Easy GA4 ( Google Analytics 4 )
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update HT Easy GA4 ( Google Analytics 4 ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Permalink Manager Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29092 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.
Product
Permalink Manager Lite
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WP Armour – Honeypot Anti Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29091 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dnesscarkey WP Armour – Honeypot Anti Spam allows Reflected XSS.This issue affects WP Armour – Honeypot Anti Spam: from n/a through 2.1.13.
Product
WP Armour – Honeypot Anti Spam
Affected
up to 2.1.13
What to do
Affects up to 2.1.13. Update WP Armour – Honeypot Anti Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Five Star Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29089 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Menu allows Stored XSS.This issue affects Five Star Restaurant Menu: from n/a through 2.4.14.
Product
Five Star Restaurant Menu
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Five Star Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27998 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27997 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.6.0.
Product
Visual Composer Website Builder
Affected
up to 45.6.0
What to do
Affects up to 45.6.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27996 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This issue affects Survey Maker: from n/a through 4.0.5.
Product
Survey Maker
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29108 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leevio Happy Addons for Elementor allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.10.1.
Product
Happy Addons for Elementor
Affected
up to 3.10.1
What to do
Affects up to 3.10.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29107 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.12.10.
Product
Elementor Addon Elements
Affected
up to 1.12.10
What to do
Affects up to 1.12.10. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29106 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.10.16.
Product
Premium Addons for Elementor
Affected
up to 4.10.16
What to do
Affects up to 4.10.16. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WP Popups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29105 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timersys WP Popups allows Stored XSS.This issue affects WP Popups: from n/a through 2.1.5.5.
Product
WP Popups
Affected
up to 2.1.5.5
What to do
Affects up to 2.1.5.5. Update WP Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Ticket Tailor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29104 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zimma Ltd. Ticket Tailor allows Stored XSS.This issue affects Ticket Tailor: from n/a through 1.10.
Product
Ticket Tailor
Affected
up to 1.10
What to do
Affects up to 1.10. Update Ticket Tailor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Database for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29103 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam Database for Contact Form 7 allows Stored XSS.This issue affects Database for Contact Form 7: from n/a through 3.0.6.
Product
Database for Contact Form 7
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Database for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Extensions For CF7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29102 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6.
Product
Extensions For CF7
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Jeg Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29101 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through 2.6.2.
Product
Jeg Elementor Kit
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Evergreen Content Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29099 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster allows Reflected XSS.This issue affects Evergreen Content Poster: from n/a through 1.4.1.
Product
Evergreen Content Poster
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Evergreen Content Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WP Calameo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calameo WP Calameo allows Stored XSS.This issue affects WP Calameo: from n/a through 2.1.7.
Product
WP Calameo
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update WP Calameo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024User profile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29097 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20.
Product
User profile
Affected
up to 2.0.20
What to do
Affects up to 2.0.20. Update User profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024MJM Clinic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29096 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic.This issue affects MJM Clinic: from n/a through 1.1.22.
Product
MJM Clinic
Affected
up to 1.1.22
What to do
Affects up to 1.1.22. Update MJM Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29095 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews.This issue affects Site Reviews: from n/a through <= 6.11.6.
Product
Site Reviews
Affected
up to 6.11.6
What to do
Affects up to 6.11.6. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Specific Content For Mobile – Customize the mobile version without redirections: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29126 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Mortellaro Specific Content For Mobile – Customize the mobile version without redirections allows Reflected XSS.This issue affects Specific Content For Mobile – Customize the mobile version without redirections: from n/a through 0.1.9.5.
Product
Specific Content For Mobile – Customize the mobile version without redirections
Affected
up to 0.1.9.5
What to do
Affects up to 0.1.9.5. Update Specific Content For Mobile – Customize the mobile version without redirections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Coupon Affiliates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29125 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage.This issue affects Coupon Affiliates: from n/a through <= 5.12.7.
Product
Coupon Affiliates
Affected
up to 5.12.7
What to do
Affects up to 5.12.7. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29124 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Stored XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29123 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.
Product
Link Library
Affected
up to 7.6
What to do
Affects up to 7.6. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29122 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
Product
FV Flowplayer Video Player
Affected
up to 7.5.41.7212
What to do
Affects up to 7.5.41.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooCommerce License Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29121 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firassaidi WooCommerce License Manager allows Reflected XSS.This issue affects WooCommerce License Manager: from n/a through 5.3.1.
Product
WooCommerce License Manager
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update WooCommerce License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Scrollsequence: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29118 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scrollsequence allows Stored XSS.This issue affects Scrollsequence: from n/a through 1.5.4.
Product
Scrollsequence
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Scrollsequence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Contact Forms by Cimatti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29117 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Stored XSS.This issue affects Contact Forms by Cimatti: from n/a through 1.7.0.
Product
Contact Forms by Cimatti
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooThumbs for WooCommerce by Iconic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29116 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IconicWP WooThumbs for WooCommerce by Iconic allows Reflected XSS.This issue affects WooThumbs for WooCommerce by Iconic: from n/a through 5.5.3.
Product
WooThumbs for WooCommerce by Iconic
Affected
up to 5.5.3
What to do
Affects up to 5.5.3. Update WooThumbs for WooCommerce by Iconic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Smart Online Order for Clover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29115 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through 1.5.5.
Product
Smart Online Order for Clover
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29114 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84.
Product
Download Manager
Affected
up to 3.2.84
What to do
Affects up to 3.2.84. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024RegistrationMagic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29113 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.2.5.9.
Product
RegistrationMagic
Affected
up to 5.2.5.9
What to do
Affects up to 5.2.5.9. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooCommerce Google Feed Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29112 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marketing Robot WooCommerce Google Feed Manager allows Stored XSS.This issue affects WooCommerce Google Feed Manager: from n/a through 2.2.0.
Product
WooCommerce Google Feed Manager
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WooCommerce Google Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Sitekit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29111 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webvitaly Sitekit allows Stored XSS.This issue affects Sitekit: from n/a through 1.6.
Product
Sitekit
Affected
up to 1.6
What to do
Affects up to 1.6. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Table & Contact Form 7 Database – Tablesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29110 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pauple Table & Contact Form 7 Database – Tablesome allows Reflected XSS.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.27.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Shariff Wrapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29109 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jan-Peter Lambeck & 3UU Shariff Wrapper allows Stored XSS.This issue affects Shariff Wrapper: from n/a through 4.6.10.
Product
Shariff Wrapper
Affected
up to 4.6.10
What to do
Affects up to 4.6.10. Update Shariff Wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Better Search – Relevant search results for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29142 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant search results for WordPress allows Stored XSS.This issue affects Better Search – Relevant search results for WordPress: from n/a through 3.3.0.
Product
Better Search – Relevant search results for
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Better Search – Relevant search results for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024PDF Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29141 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PDF Embedder allows Stored XSS.This issue affects PDF Embedder: from n/a through 4.6.4.
Product
PDF Embedder
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update PDF Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024MJM Clinic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29140 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic allows Stored XSS.This issue affects MJM Clinic: from n/a through 1.1.22.
Product
MJM Clinic
Affected
up to 1.1.22
What to do
Affects up to 1.1.22. Update MJM Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024MyCurator Content Curation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29139 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Tilly MyCurator Content Curation allows Reflected XSS.This issue affects MyCurator Content Curation: from n/a through 3.76.
Product
MyCurator Content Curation
Affected
up to 3.76
What to do
Affects up to 3.76. Update MyCurator Content Curation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Restrict User Access – Membership Plugin with Force: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29138 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through <= 2.5.
Product
Restrict User Access – Membership Plugin with Force
Affected
up to 2.5
What to do
Affects up to 2.5. Update Restrict User Access – Membership Plugin with Force to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Tourfic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29137 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.
Product
Tourfic
Affected
up to 2.11.7
What to do
Affects up to 2.11.7. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.