Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

317new WordPress flaws this week

393,460entries in the database

12,417 results · page 168 of 249

Oct 15, 2024Smart Online Order for Clover: Reflected Cross-Site ScriptingCVE-2024-8787 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Smart Online Order for Clover
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons: Reflected Cross-Site ScriptingCVE-2024-8541 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Please note that this is only exploitable when the 'Leave a Review' notice is present, which occurs after 100 orders are made and disappears after a user dismisses the notice.
Product
Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024Smart Online Order for Clover: Stored Cross-Site ScriptingCVE-2024-9895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart Online Order for Clover
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2024SlimStat Analytics: Stored Cross-Site ScriptingCVE-2024-9548 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SlimStat Analytics
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update SlimStat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024Rescue Shortcodes: Stored Cross-Site ScriptingCVE-2024-9696 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versions up to, and including, 2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rescue Shortcodes
Affected
up to 2.8
What to do
Affects up to 2.8. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024TablePress – Tables in WordPress made easy: Stored Cross-Site ScriptingCVE-2024-9595 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress – Tables in WordPress made easy
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update TablePress – Tables in WordPress made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024Category Icon: Stored Cross-Site ScriptingCVE-2024-8915 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Category Icon
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024Social Sharing (by Danny): Stored Cross-Site ScriptingCVE-2024-9704 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Sharing (by Danny)
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Social Sharing (by Danny) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024ImagePress – Image Gallery: Stored Cross-Site ScriptingCVE-2024-9776 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ImagePress – Image Gallery
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 20242D Tag Cloud: Reflected Cross-Site ScriptingCVE-2024-9670 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 2D Tag Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 6.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
2D Tag Cloud
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update 2D Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 12, 2024Mynx Page Builder: Stored Cross-Site ScriptingCVE-2024-9656 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Mynx Page Builder
Affected
up to 0.27.8
What to do
Affects up to 0.27.8. Update Mynx Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 12, 2024Forms for Mailchimp by Optin Cat – Grow Your MailChimp List: Stored Cross-Site ScriptingCVE-2024-7489 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forms for Mailchimp by Optin Cat – Grow Your MailChimp List
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Forms for Mailchimp by Optin Cat – Grow Your MailChimp List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024CM Tooltip Glossary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.
Product
CM Tooltip Glossary
Affected
up to 4.3.9
What to do
Affects up to 4.3.9. Update CM Tooltip Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024BlockMeister – Block Pattern Builder: Reflected Cross-Site ScriptingCVE-2024-9616 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BlockMeister – Block Pattern Builder
Affected
up to 3.1.10
What to do
Affects up to 3.1.10. Update BlockMeister – Block Pattern Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Increase upload file size & Maximum Execution Time limit: Reflected Cross-Site ScriptingCVE-2024-9611 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Increase upload file size & Maximum Execution Time limit
Affected
up to 2.0
What to do
Affects up to 2.0. Update Increase upload file size & Maximum Execution Time limit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Language Switcher: Reflected Cross-Site ScriptingCVE-2024-9610 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Language Switcher
Affected
up to 3.7.13
What to do
Affects up to 3.7.13. Update Language Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024PowerPress Podcasting plugin by Blubrry: Stored Cross-Site ScriptingCVE-2024-9543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versions up to, and including, 11.9.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerPress Podcasting plugin by Blubrry
Affected
up to 11.9.18
What to do
Affects up to 11.9.18. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blubrry.com plugins.trac.wordpress.org
Oct 11, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Reflected Cross-Site ScriptingCVE-2024-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Affected
up to 3.5.14
What to do
Affects up to 3.5.14. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Embed videos and respect privacy: Reflected Cross-Site ScriptingCVE-2024-9346 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Embed videos and respect privacy
Affected
up to 1.2
What to do
Affects up to 1.2. Update Embed videos and respect privacy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Download Plugins and Themes in ZIP from Dashboard: Reflected Cross-Site ScriptingCVE-2024-9232 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Download Plugins and Themes in ZIP from Dashboard
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Tainacan: Reflected Cross-Site ScriptingCVE-2024-9221 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.21.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Tainacan
Affected
up to 0.21.10
What to do
Affects up to 0.21.10. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024FULL – Cliente: Reflected Cross-Site ScriptingCVE-2024-9211 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FULL – Cliente plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.22. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
FULL – Cliente
Affected
up to 3.1.22
What to do
Affects up to 3.1.22. Update FULL – Cliente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024WP Ultimate Post Grid: Stored Cross-Site ScriptingCVE-2024-9051 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpupg-grid-with-filters shortcode in all versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Ultimate Post Grid
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update WP Ultimate Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Advanced Blocks Pro: Stored Cross-Site ScriptingCVE-2024-9074 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Advanced Blocks Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Advanced Blocks Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 9, 2024WP Builder: Stored Cross-Site ScriptingCVE-2024-9457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Builder
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update WP Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 9, 2024Products, Order & Customers Export for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9377 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Products, Order & Customers Export for WooCommerce
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update Products, Order & Customers Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Maximum Products per User for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9205 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Maximum Products per User for WooCommerce
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update Maximum Products per User for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024GDPR-Extensions-com – Consent Manager: Stored Cross-Site ScriptingCVE-2024-9072 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
GDPR-Extensions-com – Consent Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update GDPR-Extensions-com – Consent Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 9, 2024Marketing and SEO Booster: Stored Cross-Site ScriptingCVE-2024-9066 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Marketing and SEO Booster
Affected
up to 1.9.10
What to do
Affects up to 1.9.10. Update Marketing and SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 9, 2024Elementor Inline SVG: Stored Cross-Site ScriptingCVE-2024-9064 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Elementor Inline SVG
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Elementor Inline SVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 9, 2024Curator.io: Show all your social media posts in a beautiful feed.: Stored Cross-Site ScriptingCVE-2024-9057 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘feed_id’ attribute in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Curator.io: Show all your social media posts in a beautiful feed.
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Curator.io: Show all your social media posts in a beautiful feed. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Stored Cross-Site ScriptingCVE-2024-8987 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's youzify_media shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Easy Social Share Buttons: Reflected Cross-Site ScriptingCVE-2024-8729 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Easy Social Share Buttons
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Easy Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024Embed PDF Viewer: Stored Cross-Site ScriptingCVE-2024-9451 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' and 'width' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed PDF Viewer
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Auto iFrame: Stored Cross-Site ScriptingCVE-2024-9449 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Auto iFrame
Affected
up to 1.7
What to do
Affects up to 1.7. Update Auto iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024CMSMasters Content Composer: Stored Cross-Site ScriptingCVE-2024-7963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CMSMasters Content Composer
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cmsmasters.net wordfence.com
Oct 8, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-8482 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.982
What to do
Affects up to 1.3.982. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024BuddyPress Docs: Reflected Cross-Site ScriptingCVE-2024-9207 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BuddyPress Docs
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update BuddyPress Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024Survey Maker: Stored Cross-Site ScriptingCVE-2024-8488 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Survey Maker
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 8, 2024WooCommerce Multilingual & Multicurrency with WPML: Reflected Cross-Site ScriptingCVE-2024-8629 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WooCommerce Multilingual & Multicurrency with WPML
Affected
up to 5.3.7
What to do
Affects up to 5.3.7. Update WooCommerce Multilingual & Multicurrency with WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024Easy Mega Menu Plugin for WordPress – ThemeHunk: Stored Cross-Site ScriptingCVE-2024-8433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added.
Product
Easy Mega Menu Plugin for WordPress – ThemeHunk
Affected
up to 1.1.0
Fixed in
1.1.0
What to do
Update Easy Mega Menu Plugin for WordPress – ThemeHunk to 1.1.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024Image Optimizer, Resizer and CDN – Sirv: Stored Cross-Site ScriptingCVE-2024-8964 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.9
What to do
Affects up to 7.2.9. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 8, 2024Bridge Core: Stored Cross-Site ScriptingCVE-2024-9292 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bridge Core
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Bridge Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 6, 2024WP-WebAuthn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through <= 1.3.1.
Product
WP-WebAuthn
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP-WebAuthn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024ShiftController Employee Shift Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44040 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware ShiftController Employee Shift Scheduling shiftcontroller allows Stored XSS.This issue affects ShiftController Employee Shift Scheduling: from n/a through <= 4.9.64.
Product
ShiftController Employee Shift Scheduling
Affected
up to 4.9.64
What to do
Affects up to 4.9.64. Update ShiftController Employee Shift Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024WP Travel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44039 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel wp-travel allows Stored XSS.This issue affects WP Travel: from n/a through <= 9.3.1.
Product
WP Travel
Affected
up to 9.3.1
What to do
Affects up to 9.3.1. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Multipurpose Ticket Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44037 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Multipurpose Ticket Booking Manager bus-booking-manager allows Stored XSS.This issue affects Multipurpose Ticket Booking Manager: from n/a through <= 4.2.2.
Product
Multipurpose Ticket Booking Manager
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Multipurpose Ticket Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Kodex Posts likes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44036 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes allows Stored XSS.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.
Product
Kodex Posts likes
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Kodex Posts likes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Gum Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44035 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.7.
Product
Gum Elementor Addon
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Gum Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44033 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5.7.
Product
Primary Addon for Elementor
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.