Vulnerability database

5,819 results · page 74 of 117

• Dec 13, 2024WP Quick Shop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54344 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Quick Shop wp-quick-shop allows Reflected XSS.This issue affects WP Quick Shop: from n/a through <= 1.3.1.

  Product

  WP Quick Shop

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update WP Quick Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Connect Contact Form 7 to Constant Contact: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54343 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehowarde Connect Contact Form 7 to Constant Contact connect-contact-form-7-to-constant-contact-v3 allows Reflected XSS.This issue affects Connect Contact Form 7 to Constant Contact: from n/a through <= 1.4.

  Product

  Connect Contact Form 7 to Constant Contact

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Connect Contact Form 7 to Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024STAGGS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in STAGGS STAGGS staggs allows Reflected XSS.This issue affects STAGGS: from n/a through <= 2.0.0.

  Product

  STAGGS

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update STAGGS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024LabelGrid Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54341 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LabelGrid LabelGrid Tools label-grid-tools allows Reflected XSS.This issue affects LabelGrid Tools: from n/a through <= 1.3.58.

  Product

  LabelGrid Tools

  Affected

  up to 1.3.58

  What to do

  Affects up to 1.3.58. Update LabelGrid Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Simple Presenter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54340 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sylviavanos Simple Presenter simple-presenter allows Reflected XSS.This issue affects Simple Presenter: from n/a through <= 1.5.1.

  Product

  Simple Presenter

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Simple Presenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024geoFlickr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54339 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jbd7 geoFlickr geoflickr allows Reflected XSS.This issue affects geoFlickr: from n/a through <= 1.3.

  Product

  geoFlickr

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update geoFlickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Hello Event Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54338 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christer_f Hello Event Widgets For Elementor hello-event-widgets-for-elementor allows DOM-Based XSS.This issue affects Hello Event Widgets For Elementor: from n/a through <= 1.0.2.

  Product

  Hello Event Widgets For Elementor

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Hello Event Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024ImmoToolBox Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54335 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImmoSoft ImmoToolBox Connect immotoolbox-connect allows Reflected XSS.This issue affects ImmoToolBox Connect: from n/a through <= 1.3.3.

  Product

  ImmoToolBox Connect

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update ImmoToolBox Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Quran Phrases About Most People Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54334 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeshanb Quran Phrases About Most People Shortcodes quran-phrases-about-most-people-shortcodes allows DOM-Based XSS.This issue affects Quran Phrases About Most People Shortcodes: from n/a through <= 1.4.

  Product

  Quran Phrases About Most People Shortcodes

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Quran Phrases About Most People Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Check Pincode For Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54333 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Check Pincode For Woocommerce check-pincode-for-woocommerce allows Reflected XSS.This issue affects Check Pincode For Woocommerce: from n/a through <= 1.1.

  Product

  Check Pincode For Woocommerce

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Check Pincode For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024CleverNode Related Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54329 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metup CleverNode Related Content clevernode-related-content allows Reflected XSS.This issue affects CleverNode Related Content: from n/a through <= 1.1.5.

  Product

  CleverNode Related Content

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update CleverNode Related Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Invoice Payment for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54328 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linknacional Invoice Payment for WooCommerce invoice-payment-for-woocommerce allows Reflected XSS.This issue affects Invoice Payment for WooCommerce: from n/a through <= 1.7.2.

  Product

  Invoice Payment for WooCommerce

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024UNIVERSAM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54327 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in universam UNIVERSAM universam-demo allows Reflected XSS.This issue affects UNIVERSAM: from n/a through < 8.59.

  Product

  UNIVERSAM

  What to do

  Update UNIVERSAM to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024CarDealerPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54325 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DealerTrend CarDealerPress cardealerpress allows Reflected XSS.This issue affects CarDealerPress: from n/a through <= 6.6.2410.02.

  Product

  CarDealerPress

  Affected

  up to 6.6.2410.02

  What to do

  Affects up to 6.6.2410.02. Update CarDealerPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024SMSify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54324 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mtomic SMSify smsify allows Reflected XSS.This issue affects SMSify: from n/a through <= 6.0.4.

  Product

  SMSify

  Affected

  up to 6.0.4

  What to do

  Affects up to 6.0.4. Update SMSify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Media Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54322 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.4.

  Product

  Media Downloader

  Affected

  up to 0.4.7.4

  What to do

  Affects up to 0.4.7.4. Update Media Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024ICDSoft Reseller Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54320 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icdsoft ICDSoft Reseller Store icdsoft-reseller-store allows Reflected XSS.This issue affects ICDSoft Reseller Store: from n/a through <= 2.4.5.

  Product

  ICDSoft Reseller Store

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update ICDSoft Reseller Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Kundgenerator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54319 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kundgenerator Kundgenerator kundgenerator allows Reflected XSS.This issue affects Kundgenerator: from n/a through <= 1.0.6.

  Product

  Kundgenerator

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Kundgenerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024NiceJob: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54318 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through <= 3.6.5.

  Product

  NiceJob

  Affected

  up to 3.6.5

  What to do

  Affects up to 3.6.5. Update NiceJob to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Web Stories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54317 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This issue affects Web Stories: from n/a through <= 1.37.0.

  Product

  Web Stories

  Affected

  up to 1.37.0

  What to do

  Affects up to 1.37.0. Update Web Stories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54316 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows DOM-Based XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.8.

  Product

  Restaurant & Cafe Addon for Elementor

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Events Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54315 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.2.

  Product

  Events Addon for Elementor

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54314 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.6.0.

  Product

  Primary Addon for Elementor

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Persian Woocommerce SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54312 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.0.5.

  Product

  Persian Woocommerce SMS

  Affected

  up to 7.0.5

  What to do

  Affects up to 7.0.5. Update Persian Woocommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Cryptocurrency Price Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54308 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Cryptocurrency Price Widget cryptocurrency-price-widget allows Stored XSS.This issue affects Cryptocurrency Price Widget: from n/a through <= 1.2.3.

  Product

  Cryptocurrency Price Widget

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Cryptocurrency Price Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024J&T Express Malaysia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54305 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtexpress J&T Express Malaysia jt-express allows Reflected XSS.This issue affects J&T Express Malaysia: from n/a through <= 2.0.13.

  Product

  J&T Express Malaysia

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update J&T Express Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54303 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through <= 2.3.8.

  Product

  Simple Payment

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024VPSUForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54302 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.0.0.

  Product

  VPSUForm

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024FormFacade: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54301 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manidoraisamy FormFacade formfacade allows Reflected XSS.This issue affects FormFacade: from n/a through <= 1.3.6.

  Product

  FormFacade

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update FormFacade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Revi.io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54299 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revidev Revi.io revi-io-customer-and-product-reviews allows Reflected XSS.This issue affects Revi.io: from n/a through <= 5.7.3.

  Product

  Revi.io

  Affected

  up to 5.7.3

  What to do

  Affects up to 5.7.3. Update Revi.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Role Includer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54290 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Fletcher Role Includer role-includer allows Reflected XSS.This issue affects Role Includer: from n/a through <= 1.6.

  Product

  Role Includer

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Role Includer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024LDD Directory Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54288 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LDD Web Design LDD Directory Lite ldd-directory-lite allows Reflected XSS.This issue affects LDD Directory Lite: from n/a through <= 3.3.

  Product

  LDD Directory Lite

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update LDD Directory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Advanced Blog Post Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54287 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.

  Product

  Advanced Blog Post Block

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Advanced Blog Post Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Smaily for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54286 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This issue affects Smaily for WP: from n/a through <= 3.1.5.

  Product

  Smaily for WP

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Smaily for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Nias course: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54277 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based XSS.This issue affects Nias course: from n/a through <= 1.2.10.

  Product

  Nias course

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Nias course to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Poll Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54276 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devfelixmoira Poll Builder poll-builder allows Stored XSS.This issue affects Poll Builder: from n/a through <= 1.3.5.

  Product

  Poll Builder

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Poll Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024CSV to html: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54275 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wibergsweb CSV to html csv-to-html allows Reflected XSS.This issue affects CSV to html: from n/a through <= 3.08.

  Product

  CSV to html

  Affected

  up to 3.08

  What to do

  Affects up to 3.08. Update CSV to html to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54274 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.

  Product

  WordPress HelpDesk & Support Ticket System Plugin – Octrace Support

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Radius Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54272 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS.This issue affects Radius Blocks: from n/a through <= 2.1.2.

  Product

  Radius Blocks

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Radius Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024ImageRecycle pdf & image compression: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54266 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compression: from n/a through <= 3.1.16.

  Product

  ImageRecycle pdf & image compression

  Affected

  up to 3.1.16

  What to do

  Affects up to 3.1.16. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54265 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.6.

  Product

  Barcode Scanner with Inventory & Order Manager

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Shortcodes Blocks Creator Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54264 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/a through <= 2.2.0.

  Product

  Shortcodes Blocks Creator Ultimate

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Shortcodes Blocks Creator Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Pinpoint Booking System: Missing AuthorizationCVE-2024-54252 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.

  Product

  Pinpoint Booking System

  Affected

  up to 2.9.9.5.7

  What to do

  Affects up to 2.9.9.5.7. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Prodigy Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54250 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.

  Product

  Prodigy Commerce

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54246 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.

  Product

  FAQs

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54245 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.

  Product

  Clients

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Easy Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54244 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.

  Product

  Easy Replace

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Easy Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Echoza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54243 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.

  Product

  Echoza

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Echoza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Blaze Online eParcel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54240 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.

  Product

  Blaze Online eParcel for WooCommerce

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Blaze Online eParcel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.

  Product

  Board Document Manager from CHUHPL

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.