Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

509new WordPress flaws this week

397,455entries in the database

15,598 results · page 239 of 312

Mar 29, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Time-based SQL InjectionCVE-2024-0913 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied status and customer_id parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting manager or admin privileges and higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Stored Cross-Site ScriptingCVE-2024-0609 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in all versions up to, and including, 1.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Union-based SQL InjectionCVE-2024-0608 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injection via the 'email' parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2024Sydney Toolbox: Stored Cross-Site ScriptingCVE-2024-2936 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sydney Toolbox
Affected
up to 1.26
What to do
Affects up to 1.26. Update Sydney Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Easy Appointments: Stored Cross-Site ScriptingCVE-2024-2842 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Appointments
Affected
up to 3.11.18
What to do
Affects up to 3.11.18. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-2841 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'id'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Media Library Assistant: Stored Cross-Site ScriptingCVE-2024-2475 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Library Assistant
Affected
up to 3.13
What to do
Affects up to 3.13. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30422 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.1.
Product
Elementor Addon Elements
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Cornerstone: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-28002 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Cornerstone allows Reflected XSS.This issue affects Cornerstone: from n/a through 0.8.0.
Product
Cornerstone
Affected
up to 0.8.0
What to do
Affects up to 0.8.0. Update Cornerstone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Favicon Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-28001 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Favicon Rotator allows Reflected XSS.This issue affects Favicon Rotator: from n/a through 1.2.10.
Product
Favicon Rotator
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Favicon Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Preview E-mails for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27999 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digamber Pradhan Preview E-mails for WooCommerce allows Reflected XSS.This issue affects Preview E-mails for WooCommerce: from n/a through 2.2.1.
Product
Preview E-mails for WooCommerce
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Preview E-mails for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25599 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting.This issue affects Seriously Simple Podcasting: from n/a through <= 3.0.2.
Product
Seriously Simple Podcasting
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024BEAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30200 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR allows Reflected XSS.This issue affects BEAR: from n/a through 1.1.4.2.
Product
BEAR
Affected
up to 1.1.4.2
What to do
Affects up to 1.1.4.2. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape some of its settingsCVE-2024-0673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Pz-LinkCard
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0672 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Pz-LinkCard
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-2091 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2024Events Manager – Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2024-2111 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 6.4.7.1
What to do
Affects up to 6.4.7.1. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024Aparat for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29765 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Sedghi Aparat for WordPress allows Stored XSS.This issue affects Aparat for WordPress: from n/a through 2.2.0.
Product
Aparat for
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Aparat for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Molongui: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molongui allows Stored XSS.This issue affects Molongui: from n/a through 4.7.7.
Product
Molongui
Affected
up to 4.7.7
What to do
Affects up to 4.7.7. Update Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Reflected XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through 0.5.8.1.
Product
Off-Canvas Sidebars & Menus (Slidebars)
Affected
up to 0.5.8.1
What to do
Affects up to 0.5.8.1. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WP Post Disclaimer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Krunal Prajapati WP Post Disclaimer allows Stored XSS.This issue affects WP Post Disclaimer: from n/a through 1.0.3.
Product
WP Post Disclaimer
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WP Post Disclaimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Booster for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster for WooCommerce allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through 7.1.7.
Product
Booster for WooCommerce
Affected
up to 7.1.7
What to do
Affects up to 7.1.7. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Calculated Fields Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n/a through 1.2.54.
Product
Calculated Fields Form
Affected
up to 1.2.54
What to do
Affects up to 1.2.54. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Co-marquage service-public.Fr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr allows Reflected XSS.This issue affects Co-marquage service-public.Fr: from n/a through 0.5.72.
Product
Co-marquage service-public.Fr
Affected
up to 0.5.72
What to do
Affects up to 0.5.72. Update Co-marquage service-public.Fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024ReviewX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29812 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReviewX allows Stored XSS.This issue affects ReviewX: from n/a through 1.6.22.
Product
ReviewX
Affected
up to 1.6.22
What to do
Affects up to 1.6.22. Update ReviewX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Radio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29811 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftLab Radio Player allows Stored XSS.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024DearFlip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive DearFlip allows Stored XSS.This issue affects DearFlip: from n/a through 2.2.26.
Product
DearFlip
Affected
up to 2.2.26
What to do
Affects up to 2.2.26. Update DearFlip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024ReDi Restaurant Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29806 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Reservation Diary ReDi Restaurant Reservation allows Reflected XSS.This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.
Product
ReDi Restaurant Reservation
Affected
up to 24.0128
What to do
Affects up to 24.0128. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Shipping with Venipak for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29805 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShopUp Shipping with Venipak for WooCommerce allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through 1.19.5.
Product
Shipping with Venipak for WooCommerce
Affected
up to 1.19.5
What to do
Affects up to 1.19.5. Update Shipping with Venipak for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Fancy Comments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29804 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14.
Product
Fancy Comments
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Fancy Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024FlatPM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mehanoid.Pro FlatPM allows Stored XSS.This issue affects FlatPM: from n/a before 3.1.05.
Product
FlatPM
Fixed in
3.1.05
What to do
Update FlatPM to 3.1.05 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Football Pool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.3.
Product
Football Pool
Affected
up to 2.11.3
What to do
Affects up to 2.11.3. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Fullscreen Galleria: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29801 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Petri Damstén Fullscreen Galleria allows Stored XSS.This issue affects Fullscreen Galleria: from n/a through 1.6.11.
Product
Fullscreen Galleria
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update Fullscreen Galleria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WP Fast Total Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search allows Stored XSS.This issue affects WP Fast Total Search: from n/a through 1.59.211.
Product
WP Fast Total Search
Affected
up to 1.59.211
What to do
Affects up to 1.59.211. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Gratisfaction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Appsmav Gratisfaction allows Stored XSS.This issue affects Gratisfaction: from n/a through 4.3.4.
Product
Gratisfaction
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update Gratisfaction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Grid Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29797 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Darko Grid Shortcodes allows Stored XSS.This issue affects Grid Shortcodes: from n/a through 1.1.
Product
Grid Shortcodes
Affected
up to 1.1
What to do
Affects up to 1.1. Update Grid Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Hot Random Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hot Themes Hot Random Image allows Stored XSS.This issue affects Hot Random Image: from n/a through 1.8.1.
Product
Hot Random Image
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: from n/a through 4.5.24.
Product
Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more
Affected
up to 4.5.24
What to do
Affects up to 4.5.24. Update Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Conversios.Io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Conversios Conversios.Io allows Reflected XSS.This issue affects Conversios.Io: from n/a through 6.9.1.
Product
Conversios.Io
Affected
up to 6.9.1
What to do
Affects up to 6.9.1. Update Conversios.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024MailChimp Forms by MailMunch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.
Product
MailChimp Forms by MailMunch
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.93.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.93
What to do
Affects up to 1.5.93. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Bulk NoIndex & NoFollow Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29791 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through 2.01.
Product
Bulk NoIndex & NoFollow Toolkit
Affected
up to 2.01
What to do
Affects up to 2.01. Update Bulk NoIndex & NoFollow Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024SEO Plugin by Squirrly SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Squirrly SEO Plugin by Squirrly SEO allows Reflected XSS.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.3.16.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.3.16
What to do
Affects up to 12.3.16. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024OneClick Chat to Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29789 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Walter Pinem OneClick Chat to Order allows Stored XSS.This issue affects OneClick Chat to Order: from n/a through 1.0.5.
Product
OneClick Chat to Order
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update OneClick Chat to Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Podlove Web Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29788 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Web Player allows Stored XSS.This issue affects Podlove Web Player: from n/a through 5.7.1.
Product
Podlove Web Player
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29777 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator.This issue affects Forminator: from n/a through <= 1.29.0.
Product
Forminator
Affected
up to 1.29.0
What to do
Affects up to 1.29.0. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024EventPrime: Cross Site Scripting (XSS)CVE-2024-29776 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Product
EventPrime
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29775 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vinoth06. Frontend Dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through 2.2.1.
Product
Frontend Dashboard
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29774 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.
Product
WP Directory Kit
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.