Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,459 results · page 494 of 830
Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50514 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
- Product
- Ninja Forms
- Affected
- up to 3.8.16
- What to do
- Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50513 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows Stored XSS.This issue affects PostX: from n/a through <= 4.1.15.
- Product
- PostX
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Bold Page Builder: Missing AuthorizationCVE-2024-50417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Page Builder: from n/a through <= 5.1.3.
- Product
- Bold Page Builder
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Sunshine Photo Cart: Missing AuthorizationCVE-2024-49697 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024HD Quiz – Save Results Light: Missing AuthorizationCVE-2024-49689 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Harmonic Design HD Quiz – Save Results Light hd-quiz-save-results-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz – Save Results Light: from n/a through <= 0.5.
- Product
- HD Quiz – Save Results Light
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update HD Quiz – Save Results Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024WP VR: Missing AuthorizationCVE-2024-49680 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.5.
- Product
- WP VR
- Affected
- up to 8.5.5
- What to do
- Affects up to 8.5.5. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Bard: Reflected Cross-Site ScriptingCVE-2024-9830 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Bard
- Affected
- up to 2.216
- What to do
- Affects up to 2.216. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Nov 19, 2024Ashe: Reflected Cross-Site ScriptingCVE-2024-9777 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Ashe
- Affected
- up to 2.243
- What to do
- Affects up to 2.243. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Nov 19, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-11224 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Parallax Image
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024GD Rating System: Stored Cross-Site ScriptingCVE-2024-11198 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extra_class’ parameter in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GD Rating System
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024Classified Listing – Classified ads & Business Directory: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11194 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.15.1
- What to do
- Affects up to 3.1.15.1. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024Email Subscription Popup: Stored Cross-Site ScriptingCVE-2024-11195 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Email Subscription Popup
- Affected
- up to 1.2.22
- What to do
- Affects up to 1.2.22. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup: Arbitrary shortcode executionCVE-2024-11038 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Nov 19, 2024The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-11036 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in
- Affected
- up to 7.1.5
- What to do
- Affects up to 7.1.5. Update The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024SVG Block: Stored Cross-Site ScriptingCVE-2024-11098 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- SVG Block
- Affected
- up to 1.1.24
- What to do
- Affects up to 1.1.24. Update SVG Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 19, 2024WordPress GDPR: Unauthorized loss of dataCVE-2024-11069 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users.
- Product
- WordPress GDPR
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WordPress GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwelaunch.iowordfence.com
Nov 19, 2024WordPress GDPR: Stored Cross-Site ScriptingCVE-2024-10388 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WordPress GDPR
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WordPress GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwelaunch.iowordfence.com
Nov 19, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2024-10268 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 19, 2024In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editorCVE-2024-10103 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
- Product
- process of testing the MailPoet
- Fixed in
- 5.3.2
- What to do
- Update process of testing the MailPoet to 5.3.2 or newer.
Nov 18, 2024Photographer Connections: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MartyThornley Photographer Connections photographer-connections allows Stored XSS.This issue affects Photographer Connections: from n/a through <= 1.3.1.
- Product
- Photographer Connections
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Photographer Connections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Mage Front End Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maximilian Ruthe Mage Front End Forms mage-forms allows Stored XSS.This issue affects Mage Front End Forms: from n/a through <= 1.1.4.
- Product
- Mage Front End Forms
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Mage Front End Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024WP Responsive Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51940 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sohelwpexpert WP Responsive Video my-wp-responsive-video allows DOM-Based XSS.This issue affects WP Responsive Video: from n/a through <= 1.0.
- Product
- WP Responsive Video
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Responsive Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Stylish Internal Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Santhosh veer Stylish Internal Links stylish-internal-links allows DOM-Based XSS.This issue affects Stylish Internal Links: from n/a through <= 1.9.
- Product
- Stylish Internal Links
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Stylish Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Gameplan: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52418 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CactusThemes Gameplan gameplan allows Reflected XSS.This issue affects Gameplan: from n/a through <= 1.5.10.
- Product
- Gameplan
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Gameplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024ReConstruction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52417 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes ReConstruction reconstruction allows Reflected XSS.This issue affects ReConstruction: from n/a through <= 1.4.7.
- Product
- ReConstruction
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update ReConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Print PDF Generator and Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52394 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Stored XSS.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.1.6.
- Product
- Print PDF Generator and Publisher
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024CYAN Backup: Path Traversal: '.../...//'CVE-2024-52390 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3.
- Product
- CYAN Backup
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update CYAN Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through <= 2.2.0.
- Product
- WP Job Portal
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Awesome Tool Tip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Awesome Tool Tip awesome-tool-tip allows DOM-Based XSS.This issue affects Awesome Tool Tip: from n/a through <= 1.0.
- Product
- Awesome Tool Tip
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Awesome Tool Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024AA Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Extensions AA Audio Player aa-audio-player allows DOM-Based XSS.This issue affects AA Audio Player: from n/a through <= 1.0.
- Product
- AA Audio Player
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update AA Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera wp-website-creator allows Stored XSS.This issue affects Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: from n/a through <= 4.0.
- Product
- Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024SimpleGMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52346 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JavierMendezPWG SimpleGMaps simplegmaps allows Stored XSS.This issue affects SimpleGMaps: from n/a through <= 1.0.
- Product
- SimpleGMaps
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SimpleGMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024ra_qrcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52345 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RobertoAlicata ra_qrcode ra-qrcode allows Stored XSS.This issue affects ra_qrcode: from n/a through <= 2.1.0.
- Product
- ra_qrcode
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update ra_qrcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Provide Forex Signals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52344 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeies Pvt Ltd Provide Forex Signals provide-forex-signals allows Stored XSS.This issue affects Provide Forex Signals: from n/a through <= 1.0.
- Product
- Provide Forex Signals
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Provide Forex Signals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024OS Pricing Tables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52343 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Pricing Tables os-pricing-tables allows Stored XSS.This issue affects OS Pricing Tables: from n/a through <= 1.2.
- Product
- OS Pricing Tables
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update OS Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024OS BXSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allows Stored XSS.This issue affects OS BXSlider: from n/a through <= 2.6.
- Product
- OS BXSlider
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update OS BXSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024OS Our Team: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52341 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Our Team os-our-team allows Stored XSS.This issue affects OS Our Team: from n/a through <= 1.7.
- Product
- OS Our Team
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update OS Our Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Google for WooCommerce: Information DisclosureCVE-2024-10486 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
- Product
- Google for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Google for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 18, 2024Elfsight Telegram Chat CC: Unauthorized modification of data to a missing capability check on the 'updatePreferences' functionCVE-2024-10390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Elfsight Telegram Chat CC
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Elfsight Telegram Chat CC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 18, 2024Linear: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52426 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue affects Linear: from n/a through <= 2.8.0.
- Product
- Linear
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Linear to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Drozd – Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladislav Urchenko Drozd – Addons for Elementor drozd-addons-for-elementor allows Stored XSS.This issue affects Drozd – Addons for Elementor: from n/a through <= 1.1.1.
- Product
- Drozd – Addons for Elementor
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Drozd – Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024wp-login customizer: Cross-Site Request Forgery (CSRF)CVE-2024-52424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through <= 1.0.
- Product
- wp-login customizer
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update wp-login customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Themify Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52423 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored XSS.This issue affects Themify Builder: from n/a through <= 7.6.5.
- Product
- Themify Builder
- Affected
- up to 7.6.5
- What to do
- Affects up to 7.6.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024WP Githuber MD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52422 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP Githuber MD wp-githuber-md allows Stored XSS.This issue affects WP Githuber MD: from n/a through <= 1.16.3.
- Product
- WP Githuber MD
- Affected
- up to 1.16.3
- What to do
- Affects up to 1.16.3. Update WP Githuber MD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Copy Anything to Clipboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52419 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clipboard Agency Copy Anything to Clipboard copy-the-code allows Stored XSS.This issue affects Copy Anything to Clipboard: from n/a through <= 4.0.3.
- Product
- Copy Anything to Clipboard
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Copy Anything to Clipboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Post SMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52436 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection.This issue affects Post SMTP: from n/a through <= 2.9.9.
- Product
- Post SMTP
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024WPDM – Premium Packages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52435 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.5.
- Product
- WPDM – Premium Packages
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Popup by Supsystic: Deserialization of Untrusted DataCVE-2024-52434 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.29
- What to do
- Affects up to 1.10.29. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024My Geo Posts Free: Deserialization of Untrusted DataCVE-2024-52433 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.
- Product
- My Geo Posts Free
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update My Geo Posts Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.