Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,327 results · page 6 of 27
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.8
- What to do
- Update Page Builder: Pagelayer to 1.8.8 or newer.
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Download Manager
- Fixed in
- 3.2.99
- What to do
- Update Download Manager to 3.2.99 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Post Show
- Fixed in
- 3.0.1
- What to do
- Update Smart Post Show to 3.0.1 or newer.
May 15, 2025Widgets Reset: Does not have CSRF check in placeCVE-2024-8082 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Widgets Reset
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Widgets Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025ClickSold IDX: Does not sanitise and escape some of its settingsCVE-2024-7769 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- ClickSold IDX
- Affected
- up to 1.90
- What to do
- Affects up to 1.90. Update ClickSold IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PWA for WP: Does not sanitise and escape some of its settingsCVE-2024-7759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- PWA for WP
- Fixed in
- 1.7.72
- What to do
- Update PWA for WP to 1.7.72 or newer.
May 15, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-7758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Stylish Price List
- Fixed in
- 7.1.8
- What to do
- Update Stylish Price List to 7.1.8 or newer.
May 15, 2025Simple Share: Does not sanitise and escape some of its settingsCVE-2024-7556 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Share
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Simple Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025DL Verification: Does not sanitise and escape some of its settingsCVE-2024-6798 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025DL Robots.txt: Does not sanitise and escape some of its settingsCVE-2024-6797 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Robots.txt
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Robots.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PVN Auth Popup: Does not sanitise and escape some of its settingsCVE-2024-6713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025wccp-pro: Does not sanitise and escape some of its settingsCVE-2024-6693 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- wccp-pro
- Fixed in
- 15.3
- What to do
- Update wccp-pro to 15.3 or newer.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape some of its settingsCVE-2024-6665 · WordPress plugins & themes · reported by WPScanMedium 4.8
The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.6
- What to do
- Update KBucket: Your Curated Content in to 4.1.6 or newer.
May 15, 2025CTT Expresso para WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-6478 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CTT Expresso para WooCommerce
- Fixed in
- 3.2.13
- What to do
- Update CTT Expresso para WooCommerce to 3.2.13 or newer.
May 15, 2025DL Yandex Metrika: Does not sanitise and escape some of its settingsCVE-2024-6462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DL Yandex Metrika
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Yandex Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Tracking Code Manager: Does not sanitise and escape some of its settingsCVE-2024-6335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tracking Code Manager
- Fixed in
- 2.3.0
- What to do
- Update Tracking Code Manager to 2.3.0 or newer.
May 15, 2025CM Tooltip Glossary: Does not sanitise and escape some of its settingsCVE-2024-5026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CM Tooltip Glossary
- Fixed in
- 4.3.4
- What to do
- Update CM Tooltip Glossary to 4.3.4 or newer.
May 15, 2025Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-4091 · WordPress plugins & themes · reported by WPScanLow 3.5
The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.15
- What to do
- Update Responsive Gallery Grid to 2.3.15 or newer.
May 15, 2025Advanced Cron Manager: Does not sanitise and escape some of its settingsCVE-2024-4004 · WordPress plugins & themes · reported by WPScanLow 3.5
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Cron Manager
- Fixed in
- 2.5.7
- What to do
- Update Advanced Cron Manager to 2.5.7 or newer.
May 15, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-4002 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.6.9
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.6.9 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-3996 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Post Show
- Fixed in
- 2.4.28
- What to do
- Update Smart Post Show to 2.4.28 or newer.
May 15, 2025Save as Image Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2024-3062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as Image Plugin by Pdfcrowd
- Fixed in
- 3.2.2
- What to do
- Update Save as Image Plugin by Pdfcrowd to 3.2.2 or newer.
May 15, 2025Easy Property Listings: Does not sanitise and escape some of its settingsCVE-2024-2869 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
May 15, 2025Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-2643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.6.8
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.6.8 or newer.
May 15, 2025Ultimate Noindex Nofollow Tool II: Does not sanitise and escape some of its settingsCVE-2024-1663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Noindex Nofollow Tool II
- Fixed in
- 1.3.6
- What to do
- Update Ultimate Noindex Nofollow Tool II to 1.3.6 or newer.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13730 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.2.1
- What to do
- Update Podlove Podcast Publisher to 4.2.1 or newer.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13729 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.1.24
- What to do
- Update Podlove Podcast Publisher to 4.1.24 or newer.
May 15, 2025GDPR Framework By Data443: Does not sanitise and escape some of its settingsCVE-2024-13621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Framework By Data443
- Fixed in
- 2.2.0
- What to do
- Update GDPR Framework By Data443 to 2.2.0 or newer.
May 15, 2025VikBooking Hotel Booking Engine & PMS: Does not sanitise and escape some of its settingsCVE-2024-13616 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.7.2
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.7.2 or newer.
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13486 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-13384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.24
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.24 or newer.
May 15, 2025HD Quiz: Does not sanitise and escape some of its settingsCVE-2024-13383 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- HD Quiz
- Fixed in
- 2.0.0
- What to do
- Update HD Quiz to 2.0.0 or newer.
May 15, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13382 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.64
- What to do
- Update Calculated Fields Form to 5.2.64 or newer.
May 15, 2025Ditty: Does not sanitise and escape some of its settingsCVE-2024-13357 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ditty
- Fixed in
- 3.1.52
- What to do
- Update Ditty to 3.1.52 or newer.
May 15, 2025AWeber: Does not sanitise and escape some of its settingsCVE-2024-13313 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AWeber
- Affected
- up to 7.3.20
- What to do
- Affects up to 7.3.20. Update AWeber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13128 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.5.1
- What to do
- Update LearnPress to 4.2.7.5.1 or newer.
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13127 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.5.1
- What to do
- Update LearnPress to 4.2.7.5.1 or newer.
May 15, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13053 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.33
- What to do
- Update Form Maker by 10Web to 1.15.33 or newer.
May 15, 2025Top Comments: Does not sanitise and escape some of its settingsCVE-2024-12874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Top Comments
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Top Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Does not sanitise and escape some of its settingsCVE-2024-12808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Fixed in
- 1.13.4
- What to do
- Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
May 15, 2025WP ULike: Does not sanitise and escape some of its settingsCVE-2024-12770 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ULike
- Fixed in
- 4.7.6
- What to do
- Update WP ULike to 4.7.6 or newer.
May 15, 2025MailPoet: Does not sanitise and escape some of its settingsCVE-2024-12743 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MailPoet
- Fixed in
- 5.5.2
- What to do
- Update MailPoet to 5.5.2 or newer.
May 15, 2025Mobile Contact Bar: Does not sanitise and escape some of its settingsCVE-2024-12739 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Mobile Contact Bar
- Fixed in
- 3.0.5
- What to do
- Update Mobile Contact Bar to 3.0.5 or newer.
May 15, 2025Simple Basic Contact Form: Does not sanitise and escape some of its settingsCVE-2024-12716 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Basic Contact Form
- Fixed in
- 20250114
- What to do
- Update Simple Basic Contact Form to 20250114 or newer.
May 15, 2025Prisna GWT: Does not sanitise and escape some of its settingsCVE-2024-12680 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Prisna GWT
- Fixed in
- 1.4.14
- What to do
- Update Prisna GWT to 1.4.14 or newer.
May 15, 2025Prisna GWT: Does not sanitise and escape some of its settingsCVE-2024-12679 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Prisna GWT
- Fixed in
- 1.4.14
- What to do
- Update Prisna GWT to 1.4.14 or newer.
May 15, 2025Panorama: Does not sanitise and escape some of its settingsCVE-2024-11843 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Panorama
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Panorama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Geocache Stat Bar Widget: Does not sanitise and escape some of its settingsCVE-2024-11266 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Geocache Stat Bar Widget
- Affected
- up to 0.911
- What to do
- Affects up to 0.911. Update Geocache Stat Bar Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Full Screen (Page) Background Image Slideshow: Does not sanitise and escape some of its settingsCVE-2024-11221 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Full Screen (Page) Background Image Slideshow
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Full Screen (Page) Background Image Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.