Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

3,466 results · page 24 of 70

Feb 4, 2025The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting.CVE-2024-13722 · Other software · Checkmk · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.4
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
Product
NagVis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com korelogic.com
Jan 31, 2025Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version 3.8.2.CVE-2025-0930 · Other software · Lewe · reported by cve-coordination@incibe.esMedium 6.1
Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the ‘abs’ parameter in ‘/teamcal/src/index.php’.
Product
TeamCal Neo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Reflected Cross-Site ScriptingCVE-2025-0470 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.38.2
What to do
Affects up to 1.38.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass.CVE-2024-55416 · Other software · Thecontrolgroup · reported by MITRELow 3.5
DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.
Product
Voyager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 30, 2025StageShow: Reflected Cross-Site ScriptingCVE-2024-13705 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
StageShow
Affected
up to 9.8.6
What to do
Affects up to 9.8.6. Update StageShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Team Rosters: Reflected Cross-Site ScriptingCVE-2024-12320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Team Rosters
Affected
up to 4.7
What to do
Affects up to 4.7. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025System Dashboard: Reflected Cross-Site ScriptingCVE-2024-12299 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
System Dashboard
Affected
up to 2.8.17
What to do
Affects up to 2.8.17. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Ai Image Alt Text Generator for WP: Reflected Cross-Site ScriptingCVE-2024-12177 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below.CVE-2025-0746 · Other software · EmbedAI · reported by cve-coordination@incibe.esMedium 6.1
A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL.
Product
EmbedAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jan 30, 2025WP Image Uploader: Reflected Cross-Site ScriptingCVE-2024-13706 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Image Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'file' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Image Uploader
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Image Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025Simple:Press Forum: Reflected Cross-Site ScriptingCVE-2024-12409 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 6.10.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple:Press Forum
Affected
up to 6.10.11
What to do
Affects up to 6.10.11. Update Simple:Press Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025VR-Frases (collect & share quotes): Reflected Cross-Site ScriptingCVE-2025-0860 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-22636 appears to be a duplicate of this issue.
Product
VR-Frases (collect & share quotes)
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update VR-Frases (collect & share quotes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 29, 2025Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter.CVE-2024-48761 · Other software · Celk · reported by MITREHigh 8.8
Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter.
Product
Celk Saude
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 28, 2025A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browsCVE-2025-22917 · Other software · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browser of a user by including a malicious payload into the 'type' parameter of list.php.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 27, 2025Eura7 CMSmanager in version 4.6 and below is vulnerable to Reflected XSS attacks through manipulation of return GET request parameter sent to a specific endpoinCVE-2024-11348 · Other software · Eura7 · reported by cvd@cert.plMedium 5.3
Eura7 CMSmanager in version 4.6 and below is vulnerable to Reflected XSS attacks through manipulation of return GET request parameter sent to a specific endpoint. The vulnerability has been fixed by a patche patch 17012022 addressing all affected versions in use.
Product
CMSmanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Jan 26, 2025WC Affiliate – A Complete WooCommerce Affiliate: Reflected Cross-Site ScriptingCVE-2024-12334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WC Affiliate – A Complete WooCommerce Affiliate
Affected
up to 2.4
What to do
Affects up to 2.4. Update WC Affiliate – A Complete WooCommerce Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Reflected Cross-Site ScriptingCVE-2024-10636 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ays-pro.com ays-pro.com
Jan 25, 2025WP Contact Form7 Email Spam Blocker: Reflected Cross-Site ScriptingCVE-2024-13467 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Contact Form7 Email Spam Blocker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Contact Form7 Email Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 23, 2025A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0.CVE-2024-57326 · Other software · Online Pizza Delivery System Project · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. The vulnerability allows an attacker to execute arbitrary JavaScript code in the browser via unsanitized input passed through the search parameter.
Product
Online Pizza Delivery System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 23, 2025SEO Blogger to WordPress Migration using 301 Redirection: Reflected Cross-Site ScriptingCVE-2024-13422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEO Blogger to WordPress Migration using 301 Redirection
Affected
up to 0.4.8
What to do
Affects up to 0.4.8. Update SEO Blogger to WordPress Migration using 301 Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025Themify Builder: Reflected Cross-Site ScriptingCVE-2024-13319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Themify Builder
Affected
up to 7.6.5
What to do
Affects up to 7.6.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025XML for Google Merchant Center: Reflected Cross-Site ScriptingCVE-2024-13406 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
XML for Google Merchant Center
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update XML for Google Merchant Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 21, 2025An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.CVE-2024-51417 · Other software · reported by MITREMedium 6.4
An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dynamic-linq.net github.com
Jan 21, 2025In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection pageCVE-2025-24459 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Jan 21, 2025Link Library: Reflected Cross-Site ScriptingCVE-2024-13404 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Link Library
Affected
up to 7.7.2
What to do
Affects up to 7.7.2. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 19, 2025The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript CVE-2025-0583 · Other software · aEnrich Technology · reported by twcert@cert.org.twMedium 6.1
The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Product
a+HRD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 18, 2025Kubio AI Page Builder: Reflected Cross-Site ScriptingCVE-2024-13516 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Kubio AI Page Builder
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025Image Source Control Lite – Show Image Credits and Captions: Reflected Cross-Site ScriptingCVE-2024-13515 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Image Source Control Lite – Show Image Credits and Captions
Affected
up to 2.28.0
What to do
Affects up to 2.28.0. Update Image Source Control Lite – Show Image Credits and Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in get view method underCVE-2024-26157 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 5.3
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response to the client.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter.CVE-2024-26156 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 4.8
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name.CVE-2024-26154 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 4.8
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025Sandbox: Reflected Cross-Site ScriptingCVE-2024-13366 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Sandbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'debug' parameter in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Sandbox
Affected
up to 0.4
What to do
Affects up to 0.4. Update Sandbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 17, 2025Proofreading: Reflected Cross-Site ScriptingCVE-2024-12466 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Proofreading plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Proofreading
Affected
up to 1.2.1.1
What to do
Affects up to 1.2.1.1. Update Proofreading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2025WP Inventory Manager: Reflected Cross-Site ScriptingCVE-2024-13434 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Inventory Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Inventory Manager
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their priviCVE-2024-55511 · Other software · reported by MITREHigh 7.8
A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com updates.macrium.com
Jan 15, 2025DWT - Directory & Listing: Reflected Cross-Site ScriptingCVE-2025-0170 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sort_by' and 'token' parameters. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
DWT - Directory & Listing
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update DWT - Directory & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record scriptsbundle.gitbook.io wordfence.com
Jan 15, 2025UpdraftPlus: WP Backup & Migration: Reflected Cross-Site ScriptingCVE-2025-0215 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Product
UpdraftPlus: WP Backup & Migration
Affected
up to 1.24.12
What to do
Affects up to 1.24.12. Update UpdraftPlus: WP Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2025Contact Form 7 Redirect & Thank You Page: Reflected Cross-Site ScriptingCVE-2024-12423 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Contact Form 7 Redirect & Thank You Page
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Contact Form 7 Redirect & Thank You Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2025Image Gallery – Responsive Photo Gallery: Reflected Cross-Site ScriptingCVE-2024-12403 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Image Gallery – Responsive Photo Gallery
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2025Car Demon: Reflected Cross-Site ScriptingCVE-2024-13334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Car Demon
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Car Demon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2025The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS.CVE-2024-50859 · Other software · Gestioip · reported by MITREMedium 4.8
The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data.
Product
Gestioip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gestioip.net github.com
Jan 13, 2025The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.CVE-2024-46481 · Other software · Venki · reported by MITREHigh 7.2
The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.
Product
Supravizio BPM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 11, 2025Push Notification for Post and BuddyPress: Reflected Cross-Site ScriptingCVE-2024-12407 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pushnotificationid' parameter in all versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Push Notification for Post and BuddyPress
Affected
up to 2.07
What to do
Affects up to 2.07. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2025A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of aCVE-2025-0104 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7
A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.
Product
Cloud NGFW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.paloaltonetworks.com
Jan 10, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Reflected Cross-Site ScriptingCVE-2024-11327 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.CVE-2024-55226 · Other software · Dani-garcia · reported by MITREMedium 5.4
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.
Product
Vaultwarden
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 9, 2025Action Network: Reflected Cross-Site ScriptingCVE-2024-12394 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Action Network
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Action Network to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 9, 2025SEMA API: Reflected Cross-Site ScriptingCVE-2024-12285 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEMA API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘catid’ parameter in all versions up to, and including, 5.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEMA API
Affected
up to 5.27
What to do
Affects up to 5.27. Update SEMA API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 9, 2025Deliver via Shipos for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-12222 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Deliver via Shipos for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dvsfw_bulk_label_url’ parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Deliver via Shipos for WooCommerce
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Deliver via Shipos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 9, 2025ResAds: Reflected Cross-Site ScriptingCVE-2024-12122 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ResAds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ResAds
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update ResAds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.