Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

366new WordPress flaws this week

393,576entries in the database

12,427 results · page 174 of 249

Sep 17, 2024Verbosa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Verbosa verbosa allows Stored XSS.This issue affects Verbosa: from n/a through <= 1.2.3.
Product
Verbosa
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Verbosa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.
Product
Gutenberg Blocks
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024IMPress for IDX Broker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44047 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.2.
Product
IMPress for IDX Broker
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update IMPress for IDX Broker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024WCFM Marketplace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44009 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Reflected XSS.This issue affects WCFM Marketplace: from n/a through <= 3.6.11.
Product
WCFM Marketplace
Affected
up to 3.6.11
What to do
Affects up to 3.6.11. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44008 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through <= 1.13.12.
Product
Geo Mashup
Affected
up to 1.13.12
What to do
Affects up to 1.13.12. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024SKT Templates – Elementor & Gutenberg templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44007 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Templates – Elementor & Gutenberg templates skt-templates allows Reflected XSS.This issue affects SKT Templates – Elementor & Gutenberg templates: from n/a through <= 6.14.
Product
SKT Templates – Elementor & Gutenberg templates
Affected
up to 6.14
What to do
Affects up to 6.14. Update SKT Templates – Elementor & Gutenberg templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Bus Ticket Booking with Seat Reservation: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43985 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Bus Ticket Booking with Seat Reservation allows Stored XSS.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.3.5.
Product
Bus Ticket Booking with Seat Reservation
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43977 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.
Product
The Plus Addons for Elementor Page Builder Lite
Affected
up to 5.6.2
What to do
Affects up to 5.6.2. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.29.0.
Product
Name Directory
Affected
up to 1.29.0
What to do
Affects up to 1.29.0. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Custom Query Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.3.1.
Product
Custom Query Blocks
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Parabola: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44058 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Parabola allows Stored XSS.This issue affects Parabola: from n/a through 2.4.1.
Product
Parabola
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Parabola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Nirvana: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44057 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Nirvana allows Stored XSS.This issue affects Nirvana: from n/a through 1.6.3.
Product
Nirvana
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Nirvana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Mantra: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Mantra allows Stored XSS.This issue affects Mantra: from n/a through 3.3.2.
Product
Mantra
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Mantra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Fluida: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44054 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issue affects Fluida: from n/a through 1.8.8.
Product
Fluida
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update Fluida to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Opor Ayam: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44053 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This issue affects Opor Ayam: from n/a through 1.8.
Product
Opor Ayam
Affected
up to 1.8
What to do
Affects up to 1.8. Update Opor Ayam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Flipping Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45460 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manu225 Flipping Cards flipping-cards allows Stored XSS.This issue affects Flipping Cards: from n/a through <= 1.30.
Product
Flipping Cards
Affected
up to 1.30
What to do
Affects up to 1.30. Update Flipping Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Product Slider for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45459 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Reflected XSS.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.50.
Product
Product Slider for WooCommerce
Affected
up to 1.13.50
What to do
Affects up to 1.13.50. Update Product Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45458 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
Product
Spiffy Calendar
Affected
up to 4.9.13
What to do
Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45457 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
Product
Spiffy Calendar
Affected
up to 4.9.13
What to do
Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45456 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
Product
WP Meta SEO
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45455 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
Product
WP Meta SEO
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Happyforms: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44063 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.
Product
Happyforms
Affected
up to 1.26.0
What to do
Affects up to 1.26.0. Update Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Custom Field Template: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44062 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.
Product
Custom Field Template
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024Filmix: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44060 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1.
Product
Filmix
Affected
up to 1.1
What to do
Affects up to 1.1. Update Filmix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 14, 2024Bricks: Stored Cross-Site ScriptingCVE-2023-3410 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder (admin-only by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This becomes more of an issue when Bricks Builder access is granted to lower-privileged users.
Product
Bricks
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bricksbuilder.io bricksbuilder.io
Sep 14, 2024WP Booking System – Booking Calendar: Reflected Cross-Site ScriptingCVE-2024-8797 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Booking System – Booking Calendar
Affected
up to 2.0.19.8
What to do
Affects up to 2.0.19.8. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 14, 2024Waitlist Woocommerce ( Back in stock notifier ): Reflected Cross-Site ScriptingCVE-2024-8724 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Email Obfuscate Shortcode: Stored Cross-Site ScriptingCVE-2024-8747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Obfuscate Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Email Obfuscate Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 13, 2024PDF Thumbnail Generator: Reflected Cross-Site ScriptingCVE-2024-8737 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Thumbnail Generator
Affected
up to 1.3
What to do
Affects up to 1.3. Update PDF Thumbnail Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Lucas String Replace: Reflected Cross-Site ScriptingCVE-2024-8734 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Lucas String Replace
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Lucas String Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 13, 2024Roles & Capabilities: Reflected Cross-Site ScriptingCVE-2024-8732 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Roles & Capabilities
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Roles & Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Cron Jobs: Reflected Cross-Site ScriptingCVE-2024-8731 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Cron Jobs
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Cron Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Exit Notifier: Reflected Cross-Site ScriptingCVE-2024-8730 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.10.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Exit Notifier
Affected
up to 1.10.4
What to do
Affects up to 1.10.4. Update Exit Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024WordPress Affiliates Plugin — SliceWP Affiliates: Reflected Cross-Site ScriptingCVE-2024-8714 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.20. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WordPress Affiliates Plugin — SliceWP Affiliates
Affected
up to 1.1.20
What to do
Affects up to 1.1.20. Update WordPress Affiliates Plugin — SliceWP Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Beauty: Stored Cross-Site ScriptingCVE-2024-5884 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beauty
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Beauty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Tweaker5: Stored Cross-Site ScriptingCVE-2024-5870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tweaker5
Affected
up to 1.2
What to do
Affects up to 1.2. Update Tweaker5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Neighborly: Stored Cross-Site ScriptingCVE-2024-5869 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Neighborly
Affected
up to 1.4
What to do
Affects up to 1.4. Update Neighborly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Delicate: Stored Cross-Site ScriptingCVE-2024-5867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Delicate
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Delicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Triton Lite: Stored Cross-Site ScriptingCVE-2024-5789 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Triton Lite
Affected
up to 1.3
What to do
Affects up to 1.3. Update Triton Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Sep 13, 2024Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8742 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024YITH Custom Login: Reflected Cross-Site ScriptingCVE-2024-8665 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
YITH Custom Login
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update YITH Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024WP Test Email: Reflected Cross-Site ScriptingCVE-2024-8664 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Test Email
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024WP Simple Booking Calendar: Reflected Cross-Site ScriptingCVE-2024-8663 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Simple Booking Calendar
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Betheme: Stored Cross-Site ScriptingCVE-2024-5567 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Betheme
Affected
up to 27.5.5
What to do
Affects up to 27.5.5. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.muffingroup.com themeforest.net
Sep 13, 2024Avada | Website Builder For WordPress & eCommerce: Stored Cross-Site ScriptingCVE-2024-5628 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up to, and including, 3.11.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in 3.11.9. Additional hardening for alternate attack vectors was added to version 3.11.10.
Product
Avada | Website Builder For WordPress & eCommerce
Affected
up to 3.11.9
Fixed in
3.11.9
What to do
Update Avada | Website Builder For WordPress & eCommerce to 3.11.9 or newer.
Full record and what to do →NVD record avada.com avada.com
Sep 13, 2024WPFactory Helper: Reflected Cross-Site ScriptingCVE-2024-8656 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WPFactory Helper
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update WPFactory Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2024amCharts: Charts and Maps: Reflected Cross-Site ScriptingCVE-2024-8622 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amcharts_javascript' parameter in all versions up to, and including, 1.4.4 due to the ability to supply arbitrary JavaScript a lack of nonce validation on the preview functionality. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
amCharts: Charts and Maps
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update amCharts: Charts and Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Elementor Website Builder – More than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-5416 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in Elementor Editor pages. This was partially patched in version 3.23.2.
Product
Elementor Website Builder – More than Just a Page Builder
Affected
up to 3.23.4
What to do
Affects up to 3.23.4. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Advanced WordPress Backgrounds: Stored Cross-Site ScriptingCVE-2024-8045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced WordPress Backgrounds
Affected
up to 1.12.3
What to do
Affects up to 1.12.3. Update Advanced WordPress Backgrounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.