Vulnerability database

41,459 results · page 493 of 830

• Nov 19, 2024UPDATE NOTIFICATIONS: Cross-Site Request Forgery (CSRF)CVE-2024-51653 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in akira1891 UPDATE NOTIFICATIONS update-notifications allows Stored XSS.This issue affects UPDATE NOTIFICATIONS: from n/a through <= 0.3.4.

  Product

  UPDATE NOTIFICATIONS

  Affected

  up to 0.3.4

  What to do

  Affects up to 0.3.4. Update UPDATE NOTIFICATIONS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Skip To: Cross-Site Request Forgery (CSRF)CVE-2024-51652 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in marckocher Skip To skip-to allows Stored XSS.This issue affects Skip To: from n/a through <= 2.0.0.

  Product

  Skip To

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Skip To to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Random Featured Post: Cross-Site Request Forgery (CSRF)CVE-2024-51650 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scottmydollarplancom Random Featured Post random-featured-post-plugin allows Stored XSS.This issue affects Random Featured Post: from n/a through <= 1.1.3.

  Product

  Random Featured Post

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Random Featured Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Mobilize: Cross-Site Request Forgery (CSRF)CVE-2024-51649 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Patrick Lumumba Mobilize mobilize allows Stored XSS.This issue affects Mobilize: from n/a through <= 3.0.7.

  Product

  Mobilize

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Mobilize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024e-shops: Cross-Site Request Forgery (CSRF)CVE-2024-51648 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hands01 e-shops e-shops-cart2 allows Reflected XSS.This issue affects e-shops: from n/a through <= 1.0.3.

  Product

  e-shops

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update e-shops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ThemeFuse Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2024-51645 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in themefusecom ThemeFuse Maintenance Mode themefuse-maintenance-mode allows Stored XSS.This issue affects ThemeFuse Maintenance Mode: from n/a through <= 1.1.3.

  Product

  ThemeFuse Maintenance Mode

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update ThemeFuse Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Addressbook: Cross-Site Request Forgery (CSRF)CVE-2024-51644 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in samwilson Addressbook addressbook allows Stored XSS.This issue affects Addressbook: from n/a through <= 1.1.3.

  Product

  Addressbook

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Addressbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Amazon Associate Filter: Cross-Site Request Forgery (CSRF)CVE-2024-51643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ragaskar Amazon Associate Filter amazon-associate-filter allows Stored XSS.This issue affects Amazon Associate Filter: from n/a through <= 0.4.

  Product

  Amazon Associate Filter

  Affected

  up to 0.4

  What to do

  Affects up to 0.4. Update Amazon Associate Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Seo Free: Cross-Site Request Forgery (CSRF)CVE-2024-51642 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivan9146 Seo Free seo-free allows Stored XSS.This issue affects Seo Free: from n/a through <= 1.4.

  Product

  Seo Free

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Seo Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Advanced PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2024-51641 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Juan Camilo Advanced PDF Generator advanced-pdf-generator allows Stored XSS.This issue affects Advanced PDF Generator: from n/a through <= 0.4.0.

  Product

  Advanced PDF Generator

  Affected

  up to 0.4.0

  What to do

  Affects up to 0.4.0. Update Advanced PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024MDR Webmaster Tools: Cross-Site Request Forgery (CSRF)CVE-2024-51640 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through <= 1.1.

  Product

  MDR Webmaster Tools

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update MDR Webmaster Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Naver Blog: Cross-Site Request Forgery (CSRF)CVE-2024-51639 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Hints Naver Blog naver-blog-api allows Stored XSS.This issue affects Naver Blog: from n/a through <= 1.0.

  Product

  Naver Blog

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Naver Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Awesome Shortcodes For Genesis: Cross-Site Request Forgery (CSRF)CVE-2024-51638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Awesome Shortcodes For Genesis awesome-shortcodes-for-genesis allows Stored XSS.This issue affects Awesome Shortcodes For Genesis: from n/a through 1.1.8.

  Product

  Awesome Shortcodes For Genesis

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Awesome Shortcodes For Genesis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Admin SMS Alert: Cross-Site Request Forgery (CSRF)CVE-2024-51637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sroyalty Admin SMS Alert admin-sms-alert allows Stored XSS.This issue affects Admin SMS Alert: from n/a through <= 1.1.0.

  Product

  Admin SMS Alert

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Admin SMS Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024GMO Social Connection: Cross-Site Request Forgery (CSRF)CVE-2024-51636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Z.com byGMO GMO Social Connection gmo-social-connection allows Cross-Site Scripting (XSS).This issue affects GMO Social Connection: from n/a through <= 1.2.

  Product

  GMO Social Connection

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update GMO Social Connection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024While Loading: Cross-Site Request Forgery (CSRF)CVE-2024-51635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Garmur While Loading while-it-is-loading allows Stored XSS.This issue affects While Loading: from n/a through <= 3.0.

  Product

  While Loading

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update While Loading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Webriti Custom Login: Cross-Site Request Forgery (CSRF)CVE-2024-51634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Webriti Custom Login webriti-custom-login-page allows Reflected XSS.This issue affects Webriti Custom Login: from n/a through <= 0.3.

  Product

  Webriti Custom Login

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Webriti Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Simple Page Specific Sidebars: Cross-Site Request Forgery (CSRF)CVE-2024-51633 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivycat Simple Page Specific Sidebars page-specific-sidebars allows Stored XSS.This issue affects Simple Page Specific Sidebars: from n/a through <= 2.14.1.

  Product

  Simple Page Specific Sidebars

  Affected

  up to 2.14.1

  What to do

  Affects up to 2.14.1. Update Simple Page Specific Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024SH Slideshow: Cross-Site Request Forgery (CSRF)CVE-2024-51632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sam Hoe SH Slideshow sh-slideshow allows Stored XSS.This issue affects SH Slideshow: from n/a through <= 4.3.

  Product

  SH Slideshow

  Affected

  up to 4.3

  What to do

  Affects up to 4.3. Update SH Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Sticky Social Bar: Cross-Site Request Forgery (CSRF)CVE-2024-51631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Md Eftakhairul Islam Sticky Social Bar sticky-social-bar allows Cross Site Request Forgery.This issue affects Sticky Social Bar: from n/a through <= 2.0.

  Product

  Sticky Social Bar

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Sticky Social Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Clyp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51617 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clyp Clyp clyp allows Stored XSS.This issue affects Clyp: from n/a through <= 1.3.

  Product

  Clyp

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Clyp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WM Zoom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50556 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WorldMarkerter WM Zoom wm-zoom allows DOM-Based XSS.This issue affects WM Zoom: from n/a through <= 1.0.

  Product

  WM Zoom

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WM Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Sided: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50554 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sided Sided sided allows DOM-Based XSS.This issue affects Sided: from n/a through <= 1.4.5.

  Product

  Sided

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Sided to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Classy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50553 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Classy Addons Classy Addons for Elementor classy-addons-for-elementor allows DOM-Based XSS.This issue affects Classy Addons for Elementor: from n/a through <= 1.2.7.

  Product

  Classy Addons for Elementor

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update Classy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Hover Video Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50552 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jasonpancake Hover Video Preview hover-video-preview allows Stored XSS.This issue affects Hover Video Preview: from n/a through <= 1.0.2.

  Product

  Hover Video Preview

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Hover Video Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024EndomondoWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50551 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Odyno EndomondoWP endomondowp allows Stored XSS.This issue affects EndomondoWP: from n/a through <= 0.1.1.

  Product

  EndomondoWP

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update EndomondoWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Bonway Static Block Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50549 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steven Nolles Bonway Static Block Editor bonway-static-block-editor allows DOM-Based XSS.This issue affects Bonway Static Block Editor: from n/a through <= 1.1.0.

  Product

  Bonway Static Block Editor

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Bonway Static Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Awesome Progress Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50548 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abdullah Nahian Awesome Progress Bar awesome-progess-bar allows DOM-Based XSS.This issue affects Awesome Progress Bar: from n/a through <= 1.0.13.

  Product

  Awesome Progress Bar

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update Awesome Progress Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Themedy Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50547 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Hodder Themedy Toolbox themedy-toolbox allows DOM-Based XSS.This issue affects Themedy Toolbox: from n/a through <= 1.0.16.

  Product

  Themedy Toolbox

  Affected

  up to 1.0.16

  What to do

  Affects up to 1.0.16. Update Themedy Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024MyOrderDesk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50546 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riley Magnuson MyOrderDesk myorderdesk allows DOM-Based XSS.This issue affects MyOrderDesk: from n/a through <= 3.2.6.

  Product

  MyOrderDesk

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update MyOrderDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024DataMentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50545 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AuburnForest DataMentor datamentor allows DOM-Based XSS.This issue affects DataMentor: from n/a through <= 1.7.

  Product

  DataMentor

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update DataMentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024amazing neo icon font for elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mudssar amazing neo icon font for elementor amazing-neo-icon-font-for-elementor allows DOM-Based XSS.This issue affects amazing neo icon font for elementor: from n/a through <= 2.0.1.

  Product

  amazing neo icon font for elementor

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update amazing neo icon font for elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024RLM Elementor Widgets Pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50542 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zachsilberstein RLM Elementor Widgets Pack rlm-elementor-widgets-pack allows DOM-Based XSS.This issue affects RLM Elementor Widgets Pack: from n/a through <= 1.3.1.

  Product

  RLM Elementor Widgets Pack

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update RLM Elementor Widgets Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50541 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Stored XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.

  Product

  Advanced Control Manager for WordPress by ItalyStrap

  Affected

  up to 2.16.0

  What to do

  Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024(dp) AddThis: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50540 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in demixpress (dp) AddThis dp-addthis allows Stored XSS.This issue affects (dp) AddThis: from n/a through <= 1.0.2.

  Product

  (dp) AddThis

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update (dp) AddThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Show Visitor IP Address: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50538 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in irfantea Show Visitor IP Address show-visitor-ip-address allows Stored XSS.This issue affects Show Visitor IP Address: from n/a through <= 0.2.

  Product

  Show Visitor IP Address

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Show Visitor IP Address to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Smart Mockups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50537 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Marra Smart Mockups smart-mockups allows Stored XSS.This issue affects Smart Mockups: from n/a through <= 1.2.0.

  Product

  Smart Mockups

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Smart Mockups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024GDReseller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50536 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamer Ziady GDReseller gdreseller allows DOM-Based XSS.This issue affects GDReseller: from n/a through <= 1.6.

  Product

  GDReseller

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update GDReseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Step by Step: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50535 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle M Brown Step by Step step-by-step allows Stored XSS.This issue affects Step by Step: from n/a through <= 0.4.5.

  Product

  Step by Step

  Affected

  up to 0.4.5

  What to do

  Affects up to 0.4.5. Update Step by Step to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024World Prayer Time: Cross-Site Request Forgery (CSRF)CVE-2024-50534 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in techdabang World Prayer Time world-prayer-time allows Stored XSS.This issue affects World Prayer Time: from n/a through <= 2.0.

  Product

  World Prayer Time

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update World Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Domain Sharding: Cross-Site Request Forgery (CSRF)CVE-2024-50533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Garcia Domain Sharding domain-sharding allows Stored XSS.This issue affects Domain Sharding: from n/a through <= 1.2.1.

  Product

  Domain Sharding

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Domain Sharding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Events Manager Pro – extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50532 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through <= 0.1.

  Product

  Events Manager Pro – extended

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Events Manager Pro – extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WeChat Subscribers Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through <= 1.6.6.

  Product

  WeChat Subscribers Lite

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update WeChat Subscribers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Alley Elementor Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50521 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Alley Elementor Widget alley-elementor-widget allows DOM-Based XSS.This issue affects Alley Elementor Widget: from n/a through <= 1.0.7.

  Product

  Alley Elementor Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Alley Elementor Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ancient World Linked Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50520 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter J. Herrel Ancient World Linked Data ancient-world-linked-data-for-wordpress allows DOM-Based XSS.This issue affects Ancient World Linked Data: from n/a through <= 0.2.1.

  Product

  Ancient World Linked Data

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update Ancient World Linked Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Jigoshop – Store Exporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50519 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through <= 1.5.8.

  Product

  Jigoshop – Store Exporter

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Jigoshop – Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Pricer Ninja: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50518 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Pricer Ninja pricer-ninja-pricing-tables allows Stored XSS.This issue affects Pricer Ninja: from n/a through <= 2.1.0.

  Product

  Pricer Ninja

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Pricer Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ID-SK Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50517 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDSK team ID-SK Toolkit idsk-toolkit allows Stored XSS.This issue affects ID-SK Toolkit: from n/a through <= 1.7.2.

  Product

  ID-SK Toolkit

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update ID-SK Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Countdown & Clock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50516 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Countdown & Clock countdown-builder allows Stored XSS.This issue affects Countdown & Clock: from n/a through <= 3.0.8.

  Product

  Countdown & Clock

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50515 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.

  Product

  Ninja Forms

  Affected

  up to 3.8.16

  What to do

  Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.