Vulnerability database

41,417 results · page 466 of 829

• Dec 16, 2024Like in Vk.com: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilya_compman Like in Vk.com like-on-vkontakte allows Stored XSS.This issue affects Like in Vk.com: from n/a through <= 0.5.2.

  Product

  Like in Vk.com

  Affected

  up to 0.5.2

  What to do

  Affects up to 0.5.2. Update Like in Vk.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Social Media Sharing: Cross-Site Request Forgery (CSRF)CVE-2024-54423 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jesse Overright Social Media Sharing social-media-sharing allows Stored XSS.This issue affects Social Media Sharing: from n/a through <= 1.1.

  Product

  Social Media Sharing

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Social Media Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Evernote Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54422 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tgw365 Evernote Sync evernote-sync allows Reflected XSS.This issue affects Evernote Sync: from n/a through <= 3.0.0.

  Product

  Evernote Sync

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Evernote Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Floating Video Player: Cross-Site Request Forgery (CSRF)CVE-2024-54421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sanjay_Negi Floating Video Player floating-player allows Stored XSS.This issue affects Floating Video Player: from n/a through <= 1.0.

  Product

  Floating Video Player

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Floating Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Metrika: Cross-Site Request Forgery (CSRF)CVE-2024-54420 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Novikov Metrika metrika allows Cross Site Request Forgery.This issue affects Metrika: from n/a through <= 1.2.

  Product

  Metrika

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Ui Slider Filter By Price: Cross-Site Request Forgery (CSRF)CVE-2024-54419 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Cross Site Request Forgery.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.

  Product

  Ui Slider Filter By Price

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024DTC Documents: Cross-Site Request Forgery (CSRF)CVE-2024-54418 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through <= 1.1.05.

  Product

  DTC Documents

  Affected

  up to 1.1.05

  What to do

  Affects up to 1.1.05. Update DTC Documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024PixProof: Missing AuthorizationCVE-2024-54417 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.

  Product

  PixProof

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update PixProof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Wp Login with Ajax: Cross-Site Request Forgery (CSRF)CVE-2024-54416 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Navdeep Wp Login with Ajax wp-login-with-ajax allows Stored XSS.This issue affects Wp Login with Ajax: from n/a through <= 0.6.

  Product

  Wp Login with Ajax

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Wp Login with Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP-HideThat: Cross-Site Request Forgery (CSRF)CVE-2024-54415 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cconoly WP-HideThat wp-hide-that allows Stored XSS.This issue affects WP-HideThat: from n/a through <= 1.2.

  Product

  WP-HideThat

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update WP-HideThat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Geoportail Shortcode: Cross-Site Request Forgery (CSRF)CVE-2024-54414 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in geoWP Geoportail Shortcode geoportail-shortcode allows Stored XSS.This issue affects Geoportail Shortcode: from n/a through <= 2.4.4.

  Product

  Geoportail Shortcode

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Geoportail Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Display Future Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54413 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through <= 0.2.3.

  Product

  Display Future Posts

  Affected

  up to 0.2.3

  What to do

  Affects up to 0.2.3. Update Display Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024ECT Product Carousel: Cross-Site Request Forgery (CSRF)CVE-2024-54412 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carousel: from n/a through <= 1.9.

  Product

  ECT Product Carousel

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update ECT Product Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Controller: Cross-Site Request Forgery (CSRF)CVE-2024-54411 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hosting.io WP Controller wp-management-controller allows Stored XSS.This issue affects WP Controller: from n/a through <= 3.2.0.

  Product

  WP Controller

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update WP Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024SOPA Blackout: Cross-Site Request Forgery (CSRF)CVE-2024-54410 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in eagerterrier SOPA Blackout sopa-blackout allows Stored XSS.This issue affects SOPA Blackout: from n/a through <= 1.4.

  Product

  SOPA Blackout

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update SOPA Blackout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024XPD Reduce Image Filesize: Cross-Site Request Forgery (CSRF)CVE-2024-54409 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in fzmaster XPD Reduce Image Filesize xpd-reduce-image-filesize allows Stored XSS.This issue affects XPD Reduce Image Filesize: from n/a through <= 1.0.

  Product

  XPD Reduce Image Filesize

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update XPD Reduce Image Filesize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Youtube Video Grid: Cross-Site Request Forgery (CSRF)CVE-2024-54408 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Video Grid: from n/a through <= 1.9.

  Product

  Youtube Video Grid

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Youtube Video Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024CK and SyntaxHighlighter: Cross-Site Request Forgery (CSRF)CVE-2024-54407 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a328496647 CK and SyntaxHighlighter ck-and-syntaxhighlighter allows Stored XSS.This issue affects CK and SyntaxHighlighter: from n/a through <= 3.4.2.

  Product

  CK and SyntaxHighlighter

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update CK and SyntaxHighlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Comments On Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54406 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moallemi Comments On Feed comments-on-feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through <= 1.2.1.

  Product

  Comments On Feed

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Comments On Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024ECT Social Share: Cross-Site Request Forgery (CSRF)CVE-2024-54405 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Social Share ect-social-share allows Stored XSS.This issue affects ECT Social Share: from n/a through <= 1.3.

  Product

  ECT Social Share

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update ECT Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024MDC Comment Toolbar: Cross-Site Request Forgery (CSRF)CVE-2024-54404 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan MDC Comment Toolbar mdc-comment-toolbar allows Stored XSS.This issue affects MDC Comment Toolbar: from n/a through <= 1.1.

  Product

  MDC Comment Toolbar

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update MDC Comment Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Visual Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54403 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oktoberfive Visual Recent Posts visual-recent-posts allows Reflected XSS.This issue affects Visual Recent Posts: from n/a through <= 1.2.3.

  Product

  Visual Recent Posts

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Visual Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Arabic Webfonts: Missing AuthorizationCVE-2024-54402 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arabic Webfonts: from n/a through <= 1.4.6.

  Product

  Arabic Webfonts

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Arabic Webfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Advanced Fancybox: Cross-Site Request Forgery (CSRF)CVE-2024-54401 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Advanced Fancybox advanced-fancybox allows Stored XSS.This issue affects Advanced Fancybox: from n/a through <= 1.1.1.

  Product

  Advanced Fancybox

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Advanced Fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024AppMaps: Cross-Site Request Forgery (CSRF)CVE-2024-54400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in meloniq AppMaps appmaps allows Stored XSS.This issue affects AppMaps: from n/a through <= 1.1.

  Product

  AppMaps

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update AppMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024CRUDLab Google Plus Button: Cross-Site Request Forgery (CSRF)CVE-2024-54399 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google Plus Button: from n/a through <= 1.0.2.

  Product

  CRUDLab Google Plus Button

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update CRUDLab Google Plus Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Flaming Forms: Cross-Site Request Forgery (CSRF)CVE-2024-54398 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through <= 1.0.1.

  Product

  Flaming Forms

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Go Animate: Cross-Site Request Forgery (CSRF)CVE-2024-54397 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in antonio.gocaj Go Animate goanimate allows Stored XSS.This issue affects Go Animate: from n/a through <= 1.0.

  Product

  Go Animate

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Go Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Bet sport Free: Cross-Site Request Forgery (CSRF)CVE-2024-54396 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in elmervillanueva Bet sport Free bet-sport-free allows Cross Site Request Forgery.This issue affects Bet sport Free: from n/a through <= 1.0.0.

  Product

  Bet sport Free

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Bet sport Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Increase Sociability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preblogging Increase Sociability increase-sociability allows Reflected XSS.This issue affects Increase Sociability: from n/a through <= 1.3.0.

  Product

  Increase Sociability

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Increase Sociability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Mandrill WP: Cross-Site Request Forgery (CSRF)CVE-2024-54394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in khubbaib Mandrill WP email-form-under-post allows Stored XSS.This issue affects Mandrill WP: from n/a through <= 1.0.5.

  Product

  Mandrill WP

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Mandrill WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Fiddle: Cross-Site Request Forgery (CSRF)CVE-2024-54393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sheikh Heera WP Fiddle wp-fiddle allows Stored XSS.This issue affects WP Fiddle: from n/a through <= 1.0.

  Product

  WP Fiddle

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Fiddle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP微信机器人: Cross-Site Request Forgery (CSRF)CVE-2024-54392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in midoks WP微信机器人 wp-weixin-robot allows Stored XSS.This issue affects WP微信机器人: from n/a through <= 5.3.5.

  Product

  WP微信机器人

  Affected

  up to 5.3.5

  What to do

  Affects up to 5.3.5. Update WP微信机器人 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WordPress Filter: Cross-Site Request Forgery (CSRF)CVE-2024-54391 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mattwalters WordPress Filter wordpress-filter allows Stored XSS.This issue affects WordPress Filter: from n/a through <= 1.4.1.

  Product

  WordPress Filter

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update WordPress Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024TagGator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54390 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected XSS.This issue affects TagGator: from n/a through <= 1.54.

  Product

  TagGator

  Affected

  up to 1.54

  What to do

  Affects up to 1.54. Update TagGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024addWeather: Cross-Site Request Forgery (CSRF)CVE-2024-54389 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Eduardo addWeather myweather allows Cross Site Request Forgery.This issue affects addWeather: from n/a through <= 2.5.1.

  Product

  addWeather

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update addWeather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Multiple Admin Emails: Cross-Site Request Forgery (CSRF)CVE-2024-54388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through <= 1.0.

  Product

  Multiple Admin Emails

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Multiple Admin Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Posts Date Ranges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54387 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaytesh Barange Posts Date Ranges posts-date-ranges allows Reflected XSS.This issue affects Posts Date Ranges: from n/a through <= 2.2.

  Product

  Posts Date Ranges

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Posts Date Ranges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart: Cross-Site Request Forgery (CSRF)CVE-2024-54386 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in pushmonkey Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart push-monkey-desktop-push-notifications allows Cross Site Request Forgery.This issue affects Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart: from n/a through <= 3.9.

  Product

  Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Radio Player: Server-Side Request Forgery (SSRF)CVE-2024-54385 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.

  Product

  Radio Player

  Affected

  up to 2.0.83

  What to do

  Affects up to 2.0.83. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2024-54384 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Anh Tran Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through <= 2.8.3.

  Product

  Falcon – WordPress Optimizations & Tweaks

  Affected

  up to 2.8.3

  What to do

  Affects up to 2.8.3. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Bold Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54382 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through <= 5.1.5.

  Product

  Bold Page Builder

  Affected

  up to 5.1.5

  What to do

  Affects up to 5.1.5. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024WP Cookies Enabler: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54380 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Filippo Bodei WP Cookies Enabler wp-cookies-enabler allows PHP Local File Inclusion.This issue affects WP Cookies Enabler: from n/a through <= 1.0.1.

  Product

  WP Cookies Enabler

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WP Cookies Enabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Minterpress: Missing AuthorizationCVE-2024-54379 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.

  Product

  Minterpress

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Quietly Insights: Missing AuthorizationCVE-2024-54378 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through <= 1.2.2.

  Product

  Quietly Insights

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Quietly Insights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Woolook: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54375 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issue affects Woolook: from n/a through <= 1.7.0.

  Product

  Woolook

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Woolook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Sogrid: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54374 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.

  Product

  Sogrid

  Affected

  up to 1.5.6

  What to do

  Affects up to 1.5.6. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024EduAdmin Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54373 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP Local File Inclusion.This issue affects EduAdmin Booking: from n/a through <= 5.2.0.

  Product

  EduAdmin Booking

  Affected

  up to 5.2.0

  What to do

  Affects up to 5.2.0. Update EduAdmin Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Insertify: Cross-Site Request Forgery (CSRF)CVE-2024-54372 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Insertify insertify allows Code Injection.This issue affects Insertify: from n/a through <= 1.1.4.

  Product

  Insertify

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Insertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Video & Photo Gallery for Ultimate Member: Unrestricted Upload of File with Dangerous TypeCVE-2024-54370 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.

  Product

  Video & Photo Gallery for Ultimate Member

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.