Vulnerability database

41,459 results · page 490 of 830

• Nov 19, 2024HUSKY – Products Filter Professional for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11400 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  HUSKY – Products Filter Professional for WooCommerce

  Affected

  up to 1.3.6.3

  What to do

  Affects up to 1.3.6.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 19, 2024WP Roles at Registration: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-27609 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NetTantra WP Roles at Registration allows Stored XSS.This issue affects WP Roles at Registration: from n/a through 0.23.

  Product

  WP Roles at Registration

  Affected

  up to 0.23

  What to do

  Affects up to 0.23. Update WP Roles at Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50430 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.3.7.

  Product

  Beaver Builder

  Affected

  up to 2.8.3.7

  What to do

  Affects up to 2.8.3.7. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ARMember: Cross-Site Request Forgery (CSRF)CVE-2022-47424 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.

  Product

  ARMember

  Affected

  up to 4.0.5

  Fixed in

  6.7.1

  What to do

  Update ARMember to 6.7.1 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WP Popup Window Maker: Cross-Site Request Forgery (CSRF)CVE-2024-52421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through <= 2.0.

  Product

  WP Popup Window Maker

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Popup Window Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Disable Admin Notices individually: Cross-Site Request Forgery (CSRF)CVE-2024-52420 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.

  Product

  Disable Admin Notices individually

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Disable Admin Notices individually to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Exclusive Content Password Protect: Cross-Site Request Forgery (CSRF)CVE-2024-52402 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in gunghoinc Exclusive Content Password Protect exclusive-content-password-protect allows Upload a Web Shell to a Web Server.This issue affects Exclusive Content Password Protect: from n/a through <= 1.1.0.

  Product

  Exclusive Content Password Protect

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Exclusive Content Password Protect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Hacklog DownloadManager: Cross-Site Request Forgery (CSRF)CVE-2024-52401 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through <= 2.1.4.

  Product

  Hacklog DownloadManager

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Hacklog DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Floating Buttons for WooCommerce: Missing AuthorizationCVE-2024-52395 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in QuantumCloud Floating Buttons for WooCommerce shop-assistant-for-woocommerce-jarvis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Floating Buttons for WooCommerce: from n/a through <= 2.8.8.

  Product

  Floating Buttons for WooCommerce

  Affected

  up to 2.8.8

  What to do

  Affects up to 2.8.8. Update Floating Buttons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Hebrew Date: Cross-Site Request Forgery (CSRF)CVE-2024-52388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mikeage Hebrew Date hebrewdates allows Stored XSS.This issue affects Hebrew Date: from n/a through <= 2.1.0.

  Product

  Hebrew Date

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Hebrew Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Charity Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51938 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Charity Addon for Elementor charity-addon-for-elementor allows DOM-Based XSS.This issue affects Charity Addon for Elementor: from n/a through <= 1.3.2.

  Product

  Charity Addon for Elementor

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Charity Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024IA Map Analytics Basic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51937 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bnisia IA Map Analytics Basic ia-map-analytics-basic allows DOM-Based XSS.This issue affects IA Map Analytics Basic: from n/a through <= 20170413.

  Product

  IA Map Analytics Basic

  Affected

  up to 20170413

  What to do

  Affects up to 20170413. Update IA Map Analytics Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ESB Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51936 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eSparkBiz ESB Testimonials esb-testimonials allows Stored XSS.This issue affects ESB Testimonials: from n/a through <= 1.0.0.

  Product

  ESB Testimonials

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update ESB Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Fast Video and Image Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51935 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Perrow Fast Video and Image Display fast-video-and-image-display allows DOM-Based XSS.This issue affects Fast Video and Image Display: from n/a through <= 2.5.2.

  Product

  Fast Video and Image Display

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Fast Video and Image Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ekiline Block Collection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51934 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uri Lazcano Ekiline Block Collection ekiline-block-collection allows DOM-Based XSS.This issue affects Ekiline Block Collection: from n/a through <= 1.0.5.

  Product

  Ekiline Block Collection

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Ekiline Block Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Cookie Nonsense for YT: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51933 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dozyde Cookie Nonsense for YT yt-cookie-nonsense allows DOM-Based XSS.This issue affects Cookie Nonsense for YT: from n/a through <= 1.2.0.

  Product

  Cookie Nonsense for YT

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Cookie Nonsense for YT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Kings Tab Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51932 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saif Kings Tab Slider kings-tab-slider allows DOM-Based XSS.This issue affects Kings Tab Slider: from n/a through <= 1.0.

  Product

  Kings Tab Slider

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Kings Tab Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024AzonBox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51931 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shazahanul Islam Shohag AzonBox azonbox allows DOM-Based XSS.This issue affects AzonBox: from n/a through <= 1.1.2.

  Product

  AzonBox

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update AzonBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Custom URL Shortener: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51930 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IronFeet Custom URL Shortener custom-url-shorter allows Stored XSS.This issue affects Custom URL Shortener: from n/a through <= 0.3.6.

  Product

  Custom URL Shortener

  Affected

  up to 0.3.6

  What to do

  Affects up to 0.3.6. Update Custom URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Icon Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51929 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in philspectrum Icon Widget icon-widget-with-links allows DOM-Based XSS.This issue affects Icon Widget: from n/a through <= 1.1.0.

  Product

  Icon Widget

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Icon Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Blocks Post Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51928 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakir Hasan Blocks Post Grid blocks-post-grid allows DOM-Based XSS.This issue affects Blocks Post Grid: from n/a through <= 1.0.3.

  Product

  Blocks Post Grid

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Blocks Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Rig Elements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51927 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asaduzzaman Abir Rig Elements For Elementor rig-elements allows DOM-Based XSS.This issue affects Rig Elements For Elementor: from n/a through <= 1.0.

  Product

  Rig Elements For Elementor

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Rig Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024GreenCon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51926 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul GreenCon greencon allows Stored XSS.This issue affects GreenCon: from n/a through <= 1.0.1.

  Product

  GreenCon

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update GreenCon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Testimonial Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51925 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Testimonial Slider Shortcode testimonial-slider-shortcode allows Stored XSS.This issue affects Testimonial Slider Shortcode: from n/a through <= 1.1.9.

  Product

  Testimonial Slider Shortcode

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Testimonial Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WP Agenda: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51924 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alexandremagno WP Agenda wp-agenda allows Stored XSS.This issue affects WP Agenda: from n/a through <= 2.0.

  Product

  WP Agenda

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update WP Agenda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Websand Subscription Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51923 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Websand Websand Subscription Form websand-subscription-form allows Stored XSS.This issue affects Websand Subscription Form: from n/a through <= 1.0.3.

  Product

  Websand Subscription Form

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Websand Subscription Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024VP Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51922 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maruf Arafat VP Sitemap vp-sitemap allows Stored XSS.This issue affects VP Sitemap: from n/a through <= 1.0.

  Product

  VP Sitemap

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update VP Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024scrollup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51921 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in midori scrollup scrollup allows DOM-Based XSS.This issue affects scrollup: from n/a through <= 1.1.

  Product

  scrollup

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update scrollup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Map Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51920 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Jégo Map Store Locator map-store-location allows DOM-Based XSS.This issue affects Map Store Locator: from n/a through <= 1.2.1.

  Product

  Map Store Locator

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Map Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Pay With Stripe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51918 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Pay With Stripe payments-stripe-gateway allows DOM-Based XSS.This issue affects Pay With Stripe: from n/a through <= 1.2.1.

  Product

  Pay With Stripe

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Pay With Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Multiple Votes in one page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51917 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lequanghuylc Multiple Votes in one page multiple-votes-in-one-page allows Stored XSS.This issue affects Multiple Votes in one page: from n/a through <= 1.0.4.

  Product

  Multiple Votes in one page

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Multiple Votes in one page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Multifox Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51916 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox Plus multifox-plus allows DOM-Based XSS.This issue affects Multifox Plus: from n/a through <= 1.1.6.

  Product

  Multifox Plus

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Multifox Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024drop in image slideshow gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51914 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus drop in image slideshow gallery drop-in-image-slideshow-gallery allows DOM-Based XSS.This issue affects drop in image slideshow gallery: from n/a through <= 12.0.

  Product

  drop in image slideshow gallery

  Affected

  up to 12.0

  What to do

  Affects up to 12.0. Update drop in image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Mapme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51913 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapme Mapme mapme allows Stored XSS.This issue affects Mapme: from n/a through <= 1.3.2.

  Product

  Mapme

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Mapme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024IntelliWidget Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51912 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lilaeamedia IntelliWidget Elements intelliwidget-elements allows DOM-Based XSS.This issue affects IntelliWidget Elements: from n/a through <= 2.2.7.

  Product

  IntelliWidget Elements

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update IntelliWidget Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Featured product by category name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51911 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ketan Patel Featured product by category name featured-product-by-category-name allows DOM-Based XSS.This issue affects Featured product by category name: from n/a through <= 1.1.

  Product

  Featured product by category name

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Featured product by category name to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Assist24 Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51910 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ezlab Assist24 Help Desk assist24it allows DOM-Based XSS.This issue affects Assist24 Help Desk: from n/a through <= 20150401.2.

  Product

  Assist24 Help Desk

  Affected

  up to 20150401.2

  What to do

  Affects up to 20150401.2. Update Assist24 Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024audioCase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51909 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Monarkie DCS audioCase audiocase allows DOM-Based XSS.This issue affects audioCase: from n/a through <= 1.2.1.

  Product

  audioCase

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update audioCase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Adventure Bucket List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51908 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinabl Adventure Bucket List adventure-bucket-list allows DOM-Based XSS.This issue affects Adventure Bucket List: from n/a through <= 1.0.9.

  Product

  Adventure Bucket List

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Adventure Bucket List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WP Virtual Room Configurator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51907 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen WP Virtual Room Configurator configure-conference-room allows Stored XSS.This issue affects WP Virtual Room Configurator: from n/a through <= 1.0.0.

  Product

  WP Virtual Room Configurator

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Virtual Room Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024RSV 360 View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51906 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ravi Kumar Vanukuru RSV 360 View rsv-360-view allows DOM-Based XSS.This issue affects RSV 360 View: from n/a through <= 1.0.

  Product

  RSV 360 View

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update RSV 360 View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024RSV PDF Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51905 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ravi Kumar Vanukuru RSV PDF Preview rsv-pdf-preview allows Stored XSS.This issue affects RSV PDF Preview: from n/a through <= 1.0.

  Product

  RSV PDF Preview

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update RSV PDF Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Embed documents shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51904 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joan Boluda Embed documents shortcode embed-documents-shortcode allows Stored XSS.This issue affects Embed documents shortcode: from n/a through <= 1.5.

  Product

  Embed documents shortcode

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Embed documents shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WP Listings Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51903 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brandon Hubbard WP Listings Pro wp-listings-pro allows Stored XSS.This issue affects WP Listings Pro: from n/a through <= 3.0.14.

  Product

  WP Listings Pro

  Affected

  up to 3.0.14

  What to do

  Affects up to 3.0.14. Update WP Listings Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024TinyCode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51902 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybio TinyCode tinycode allows Stored XSS.This issue affects TinyCode: from n/a through <= 1.2.1.

  Product

  TinyCode

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update TinyCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Smooth Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51901 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wojciechborowicz Smooth Maps colour-smooth-maps allows Stored XSS.This issue affects Smooth Maps: from n/a through <= 1.1.

  Product

  Smooth Maps

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Smooth Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Simple Pricing Table: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51899 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes Simple Pricing Table simple-pricing-table allows Stored XSS.This issue affects Simple Pricing Table: from n/a through <= 1.0.0.

  Product

  Simple Pricing Table

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Simple Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Semantic Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51898 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sachin8600 Semantic Shortcode semantic-shortcode allows Stored XSS.This issue affects Semantic Shortcode: from n/a through <= 1.0.1.

  Product

  Semantic Shortcode

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Semantic Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024News Articles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51897 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erik Saulnier News Articles news-articles allows Stored XSS.This issue affects News Articles: from n/a through <= 1.0.0.

  Product

  News Articles

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update News Articles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Magic Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51896 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Magic Slider magic-slider allows Stored XSS.This issue affects Magic Slider: from n/a through <= 1.3.

  Product

  Magic Slider

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Magic Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.