Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

4,962 results · page 58 of 100

Dec 24, 2024Optio Dentistry: Stored Cross-Site ScriptingCVE-2024-12507 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Optio Dentistry
Affected
up to 2.1
What to do
Affects up to 2.1. Update Optio Dentistry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 23, 2024Elementor Header & Footer Builder: Stored Cross-Site ScriptingCVE-2024-11230 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Header & Footer Builder
Affected
up to 1.6.46
What to do
Affects up to 1.6.46. Update Elementor Header & Footer Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024MagicPost: Stored Cross-Site ScriptingCVE-2024-12591 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wb_share_social shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MagicPost
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update MagicPost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 21, 2024Elementor Website Builder – More than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-10453 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Settings in all versions up to, and including, 3.25.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Website Builder – More than Just a Page Builder
Affected
up to 3.25.9
What to do
Affects up to 3.25.9. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024Shortcodes and extra features for Phlox: Stored Cross-Site ScriptingCVE-2024-9545 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_contact_box and aux_gmaps shortcodes in all versions up to, and including, 2.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Shortcodes and extra features for Phlox: Stored Cross-Site ScriptingCVE-2024-12588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.17.2
What to do
Affects up to 2.17.2. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024real.Kit: Stored Cross-Site ScriptingCVE-2024-12697 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
real.Kit
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update real.Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 21, 2024Ebook Store: Reflected Cross-Site ScriptingCVE-2024-12262 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ebook Store
Affected
up to 5.8001
What to do
Affects up to 5.8001. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 21, 2024G Web Pro Store Locator: Reflected Cross-Site ScriptingCVE-2024-11682 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
G Web Pro Store Locator
Affected
up to 2.1
What to do
Affects up to 2.1. Update G Web Pro Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024Ebook Store: Reflected Cross-Site ScriptingCVE-2024-11287 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.8001. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ebook Store
Affected
up to 5.8001
What to do
Affects up to 5.8001. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Multi-column Tag Map: Stored Cross-Site ScriptingCVE-2024-11196 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and including, 17.0.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Multi-column Tag Map
Affected
up to 17.0.33
What to do
Affects up to 17.0.33. Update Multi-column Tag Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024WP SHAPES: Stored Cross-Site ScriptingCVE-2024-9619 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP SHAPES
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP SHAPES to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 20, 2024Store Locator for WordPress with Google Maps – LotsOfLocales: Local File Inclusion in version 3CVE-2024-12571 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Store Locator for WordPress with Google Maps – LotsOfLocales
What to do
Update Store Locator for WordPress with Google Maps – LotsOfLocales to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2024Embed Twine: Stored Cross-Site ScriptingCVE-2024-12509 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed_twine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed Twine
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update Embed Twine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 20, 2024NACC: Stored Cross-Site ScriptingCVE-2024-12506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NACC
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update NACC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024Spoki – Chat Buttons and WooCommerce Notifications: Stored Cross-Site ScriptingCVE-2024-11893 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spoki_button' shortcode in all versions up to, and including, 2.15.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spoki – Chat Buttons and WooCommerce Notifications
Affected
up to 2.15.15
What to do
Affects up to 2.15.15. Update Spoki – Chat Buttons and WooCommerce Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024Category Post Slider: Stored Cross-Site ScriptingCVE-2024-11878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Category Post Slider
Affected
up to 1.4
What to do
Affects up to 1.4. Update Category Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2024Sell Tickets Online – TicketSource Ticket Shop for: Stored Cross-Site ScriptingCVE-2024-11784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sell Tickets Online – TicketSource Ticket Shop for
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Sell Tickets Online – TicketSource Ticket Shop for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024Financial Calculator: Stored Cross-Site ScriptingCVE-2024-11783 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'finance_calculator' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Financial Calculator
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Financial Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2024Particle Background: Stored Cross-Site ScriptingCVE-2024-11775 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Particle Background
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Particle Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 20, 2024Outdooractive Embed: Stored Cross-Site ScriptingCVE-2024-11774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Outdooractive Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list2go' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Outdooractive Embed
Affected
up to 1.5
What to do
Affects up to 1.5. Update Outdooractive Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2024Spotlightr: Stored Cross-Site ScriptingCVE-2024-11411 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including, 0.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spotlightr
Affected
up to 0.1.11
What to do
Affects up to 0.1.11. Update Spotlightr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2024PCRecruiter Extensions: Stored Cross-Site ScriptingCVE-2024-11776 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PCRecruiter Extensions
Affected
up to 1.4.22
What to do
Affects up to 1.4.22. Update PCRecruiter Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024Video Share VOD – Turnkey Video Site Builder Script: Stored Cross-Site ScriptingCVE-2024-12449 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Video Share VOD – Turnkey Video Site Builder Script
Affected
up to 2.6.30
What to do
Affects up to 2.6.30. Update Video Share VOD – Turnkey Video Site Builder Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024Contests by Rewards Fuel: Stored Cross-Site ScriptingCVE-2024-12513 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contests by Rewards Fuel
Affected
up to 2.0.65
What to do
Affects up to 2.0.65. Update Contests by Rewards Fuel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024Philantro – Donations and Donor Management: Stored Cross-Site ScriptingCVE-2024-12500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Philantro – Donations and Donor Management
Affected
up to 5.2
What to do
Affects up to 5.2. Update Philantro – Donations and Donor Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Easy Waveform Player: Stored Cross-Site ScriptingCVE-2024-11881 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Waveform Player
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Easy Waveform Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Taeggie Feed: Stored Cross-Site ScriptingCVE-2024-11748 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Taeggie Feed
Affected
up to 0.1.9
What to do
Affects up to 0.1.9. Update Taeggie Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024ScanCircle: Stored Cross-Site ScriptingCVE-2024-11439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ScanCircle
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update ScanCircle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-12024 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Note: this vulnerability requires the "Guest Submissions" setting to be enabled. It is disabled by default.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.0.7.3
What to do
Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024TPG Get Posts: Stored Cross-Site ScriptingCVE-2024-11906 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpg_get_posts' shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TPG Get Posts
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update TPG Get Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 16, 2024Animated Counters: Stored Cross-Site ScriptingCVE-2024-11905 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Animated Counters
Affected
up to 2.0
What to do
Affects up to 2.0. Update Animated Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 16, 2024Slope Widgets: Stored Cross-Site ScriptingCVE-2024-11902 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slope Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slope-reservations' shortcode in all versions up to, and including, 4.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slope Widgets
Affected
up to 4.2.12
What to do
Affects up to 4.2.12. Update Slope Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024Portfolio – Filterable Masonry Portfolio Gallery for Professionals: Stored Cross-Site ScriptingCVE-2024-11900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Portfolio – Filterable Masonry Portfolio Gallery for Professionals
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Portfolio – Filterable Masonry Portfolio Gallery for Professionals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout: Stored Cross-Site ScriptingCVE-2024-12443 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2024-11720 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when lower-level users have been granted access to submit specific forms, which is disabled by default.
Product
Frontend Admin by DynamiApps
Affected
up to 3.24.5
What to do
Affects up to 3.24.5. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024bodi0`s Easy cache: Stored Cross-Site ScriptingCVE-2024-12628 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
bodi0`s Easy cache
Affected
up to 0.8
What to do
Affects up to 0.8. Update bodi0`s Easy cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org getastra.com
Dec 14, 2024Post to Pdf: Stored Cross-Site ScriptingCVE-2024-12446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post to Pdf
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post to Pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Simple Locator: Stored Cross-Site ScriptingCVE-2024-12501 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Locator
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Simple Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024GeoDataSource Country Region DropDown: Stored Cross-Site ScriptingCVE-2024-12474 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeoDataSource Country Region DropDown
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update GeoDataSource Country Region DropDown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Ganohrs Toggle Shortcode: Stored Cross-Site ScriptingCVE-2024-12459 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ganohrs Toggle Shortcode
Affected
up to 0.2.4
What to do
Affects up to 0.2.4. Update Ganohrs Toggle Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Eveeno: Stored Cross-Site ScriptingCVE-2024-11752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Eveeno
Affected
up to 1.7
What to do
Affects up to 1.7. Update Eveeno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-10646 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024States Map US: Stored Cross-Site ScriptingCVE-2024-12523 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
States Map US
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update States Map US to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024WooCommerce Cart Count Shortcode: Stored Cross-Site ScriptingCVE-2024-12517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WooCommerce Cart Count Shortcode
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WooCommerce Cart Count Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024My IDX Home Search: Stored Cross-Site ScriptingCVE-2024-12502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My IDX Home Search
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update My IDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Smart PopUp Blaster: Stored Cross-Site ScriptingCVE-2024-12458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart PopUp Blaster
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart PopUp Blaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 14, 2024Posts and Products Views for WooCommerce: Stored Cross-Site ScriptingCVE-2024-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Posts and Products Views for WooCommerce
Affected
up to 2.1
What to do
Affects up to 2.1. Update Posts and Products Views for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More: Stored Cross-Site ScriptingCVE-2024-12411 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024The Permalinker: Stored Cross-Site ScriptingCVE-2024-11894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Permalinker
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update The Permalinker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.