Vulnerability database

15,933 results · page 176 of 319

• Jan 2, 2025Coins MarketCap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56257 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolPlugins Coins MarketCap coins-marketcap allows DOM-Based XSS.This issue affects Coins MarketCap: from n/a through <= 5.5.8.

  Product

  Coins MarketCap

  Affected

  up to 5.5.8

  What to do

  Affects up to 5.5.8. Update Coins MarketCap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Olivia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56014 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markyis Cool Olivia allows Reflected XSS.This issue affects Olivia: from n/a through 0.9.5.

  Product

  Olivia

  Affected

  up to 0.9.5

  What to do

  Affects up to 0.9.5. Update Olivia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025ListingPro: Cross-Site Request Forgery (CSRF)CVE-2024-39623 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.

  Product

  ListingPro

  Affected

  up to 2.9.4

  What to do

  Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2024-38778 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.69.234.

  Product

  WP Fast Total Search

  Affected

  up to 1.69.234

  What to do

  Affects up to 1.69.234. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025i-transform: Cross-Site Request Forgery (CSRF)CVE-2024-38764 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9.

  Product

  i-transform

  Affected

  up to 3.0.9

  What to do

  Affects up to 3.0.9. Update i-transform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025ConvertCalculator for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56302 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jorisderuiter ConvertCalculator for WordPress convertcalculator allows Stored XSS.This issue affects ConvertCalculator for WordPress: from n/a through <= 1.1.1.

  Product

  ConvertCalculator for

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update ConvertCalculator for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Interactive UK Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56267 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive UK Map interactive-uk-map allows Stored XSS.This issue affects Interactive UK Map: from n/a through <= 3.4.8.

  Product

  Interactive UK Map

  Affected

  up to 3.4.8

  What to do

  Affects up to 3.4.8. Update Interactive UK Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025GS Shots for Dribbble: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56263 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Shots for Dribbble gs-dribbble-portfolio allows DOM-Based XSS.This issue affects GS Shots for Dribbble: from n/a through <= 1.2.0.

  Product

  GS Shots for Dribbble

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update GS Shots for Dribbble to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025GS Coaches: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56262 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Coaches gs-coach allows Stored XSS.This issue affects GS Coaches: from n/a through <= 1.1.0.

  Product

  GS Coaches

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update GS Coaches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Project Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56261 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins Project Showcase gs-projects allows Stored XSS.This issue affects Project Showcase: from n/a through <= 1.1.1.

  Product

  Project Showcase

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Project Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025ShopElement: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56260 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StorePlugin ShopElement shopelement allows Stored XSS.This issue affects ShopElement: from n/a through <= 2.0.0.

  Product

  ShopElement

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update ShopElement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56259 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.84.

  Product

  GeoDirectory

  Affected

  up to 2.3.84

  What to do

  Affects up to 2.3.84. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Magazine Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56258 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows Stored XSS.This issue affects Magazine Blocks: from n/a through <= 1.3.20.

  Product

  Magazine Blocks

  Affected

  up to 1.3.20

  What to do

  Affects up to 1.3.20. Update Magazine Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Move Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56254 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through <= 1.3.6.

  Product

  Move Addons for Elementor

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Enter Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56252 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.9.

  Product

  Enter Addons

  Affected

  up to 2.1.9

  What to do

  Affects up to 2.1.9. Update Enter Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Event Espresso 4 Decaf: Cross-Site Request Forgery (CSRF)CVE-2024-56251 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.28.decaf.

  Product

  Event Espresso 4 Decaf

  Affected

  up to 5.0.28.decaf

  What to do

  Affects up to 5.0.28.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Nexter Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56246 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows DOM-Based XSS.This issue affects Nexter Blocks: from n/a through <= 4.0.4.

  Product

  Nexter Blocks

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Premium Blocks – Gutenberg Blocks for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56245 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Stored XSS.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through <= 2.1.42.

  Product

  Premium Blocks – Gutenberg Blocks for

  Affected

  up to 2.1.42

  What to do

  Affects up to 2.1.42. Update Premium Blocks – Gutenberg Blocks for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56242 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.14.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.14

  What to do

  Affects up to 2.1.14. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56241 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.1.3.

  Product

  WPKoi Templates for Elementor

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Pronamic Google Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56240 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pronamic Pronamic Google Maps pronamic-google-maps allows Stored XSS.This issue affects Pronamic Google Maps: from n/a through <= 2.3.2.

  Product

  Pronamic Google Maps

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update Pronamic Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Themify Audio Dock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56239 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.4.

  Product

  Themify Audio Dock

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Themify Audio Dock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56237 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 24.0.3.

  Product

  Contest Gallery

  Affected

  up to 24.0.3

  What to do

  Affects up to 24.0.3. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Simple Proxy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56026 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg – SiteOrigin Simple Proxy simple-proxy allows Reflected XSS.This issue affects Simple Proxy: from n/a through <= 1.0.

  Product

  Simple Proxy

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Proxy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025AdWork Media EZ Content Locker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56025 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adworkmedia AdWork Media EZ Content Locker adwork-media-ez-content-locker allows Reflected XSS.This issue affects AdWork Media EZ Content Locker: from n/a through <= 3.0.

  Product

  AdWork Media EZ Content Locker

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update AdWork Media EZ Content Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56024 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Reflected XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.

  Product

  Custom Dashboard Widget

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WP eCommerce Quickpay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56023 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PerfectSolution WP eCommerce Quickpay wp-ecommerce-quickpay allows Reflected XSS.This issue affects WP eCommerce Quickpay: from n/a through <= 1.1.0.

  Product

  WP eCommerce Quickpay

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WP eCommerce Quickpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Preloader by WordPress Monsters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56022 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress Monsters Preloader by WordPress Monsters preloader-sws allows Reflected XSS.This issue affects Preloader by WordPress Monsters: from n/a through <= 1.2.3.

  Product

  Preloader by WordPress Monsters

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Preloader by WordPress Monsters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025BU Section Editing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56018 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Section Editing bu-section-editing allows Reflected XSS.This issue affects BU Section Editing: from n/a through <= 0.9.9.

  Product

  BU Section Editing

  Affected

  up to 0.9.9

  What to do

  Affects up to 0.9.9. Update BU Section Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Email Address Encoder: Cross-Site Request Forgery (CSRF)CVE-2024-43927 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through <= 1.0.23.

  Product

  Email Address Encoder

  Affected

  up to 1.0.23

  What to do

  Affects up to 1.0.23. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Smartsupp – live chat, chatbots, AI and lead generation: Cross-Site Request Forgery (CSRF)CVE-2024-38790 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.

  Product

  Smartsupp – live chat, chatbots, AI and lead generation

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Smartsupp – live chat, chatbots, AI and lead generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Telegram Bot & Channel: Cross-Site Request Forgery (CSRF)CVE-2024-38789 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through <= 3.8.2.

  Product

  Telegram Bot & Channel

  Affected

  up to 3.8.2

  What to do

  Affects up to 3.8.2. Update Telegram Bot & Channel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Matomo Analytics: Cross-Site Request Forgery (CSRF)CVE-2024-38766 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in matomoteam Matomo Analytics matomo allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through <= 5.1.1.

  Product

  Matomo Analytics

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Matomo Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Oceanic: Cross-Site Request Forgery (CSRF)CVE-2024-38765 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in outtheboxthemes Oceanic oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a through <= 1.0.48.

  Product

  Oceanic

  Affected

  up to 1.0.48

  What to do

  Affects up to 1.0.48. Update Oceanic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Popularis Verse: Cross-Site Request Forgery (CSRF)CVE-2024-38763 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through <= 1.1.1.

  Product

  Popularis Verse

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Popularis Verse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Event Tickets: Cross-Site Request Forgery (CSRF)CVE-2024-38762 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through <= 5.11.0.4.

  Product

  Event Tickets

  Affected

  up to 5.11.0.4

  What to do

  Affects up to 5.11.0.4. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Taggbox: Cross-Site Request Forgery (CSRF)CVE-2024-38754 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Taggbox Taggbox taggbox-widget allows Cross Site Request Forgery.This issue affects Taggbox: from n/a through <= 3.3.

  Product

  Taggbox

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Animated Rotating Words: Cross-Site Request Forgery (CSRF)CVE-2024-38753 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Cross Site Request Forgery.This issue affects Animated Rotating Words: from n/a through <= 5.6.

  Product

  Animated Rotating Words

  Affected

  up to 5.6

  What to do

  Affects up to 5.6. Update Animated Rotating Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Google Adsense & Banner Ads by AdsforWP: Cross-Site Request Forgery (CSRF)CVE-2024-38751 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Magazine3 Google Adsense & Banner Ads by AdsforWP ads-for-wp allows Cross Site Request Forgery.This issue affects Google Adsense & Banner Ads by AdsforWP: from n/a through <= 1.9.28.

  Product

  Google Adsense & Banner Ads by AdsforWP

  Affected

  up to 1.9.28

  What to do

  Affects up to 1.9.28. Update Google Adsense & Banner Ads by AdsforWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025MBE eShip: Cross-Site Request Forgery (CSRF)CVE-2024-38729 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in mbeelink MBE eShip mail-boxes-etc allows Cross Site Request Forgery.This issue affects MBE eShip: from n/a through <= 2.1.2.

  Product

  MBE eShip

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update MBE eShip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Metorik – Reports & Email Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-38691 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through <= 1.7.1.

  Product

  Metorik – Reports & Email Automation for WooCommerce

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Metorik – Reports & Email Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Rara Business: Cross-Site Request Forgery (CSRF)CVE-2024-37937 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Rara Business rara-business allows Cross Site Request Forgery.This issue affects Rara Business: from n/a through <= 1.2.5.

  Product

  Rara Business

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Rara Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Ultimate Auction: Cross-Site Request Forgery (CSRF)CVE-2024-37543 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through <= 4.2.5.

  Product

  Ultimate Auction

  Affected

  up to 4.2.5

  What to do

  Affects up to 4.2.5. Update Ultimate Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Leaky Paywall: Cross-Site Request Forgery (CSRF)CVE-2024-37540 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through <= 4.21.2.

  Product

  Leaky Paywall

  Affected

  up to 4.21.2

  What to do

  Affects up to 4.21.2. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-37518 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.5.1.4.

  Product

  The Events Calendar

  Affected

  up to 6.5.1.4

  What to do

  Affects up to 6.5.1.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Swift Performance Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37511 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.

  Product

  Swift Performance Lite

  Affected

  up to 2.3.6.20

  What to do

  Affects up to 2.3.6.20. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Construction Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37508 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through <= 1.3.5.

  Product

  Construction Landing Page

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Lawyer Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37503 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Cross Site Request Forgery.This issue affects Lawyer Landing Page: from n/a through <= 1.2.4.

  Product

  Lawyer Landing Page

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Lawyer Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Posterity: Cross-Site Request Forgery (CSRF)CVE-2024-37493 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Posterity posterity allows Cross Site Request Forgery.This issue affects Posterity: from n/a through <= 3.3.

  Product

  Posterity

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Posterity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Rife Free: Cross-Site Request Forgery (CSRF)CVE-2024-37491 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in apollo13themes Rife Free rife-free allows Cross Site Request Forgery.This issue affects Rife Free: from n/a through <= 2.4.18.

  Product

  Rife Free

  Affected

  up to 2.4.18

  What to do

  Affects up to 2.4.18. Update Rife Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.