Vulnerability database

5,859 results · page 74 of 118

• Jan 2, 2025Easy Language Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamwinner Easy Language Switcher easy-language-switcher allows Reflected XSS.This issue affects Easy Language Switcher: from n/a through <= 1.0.

  Product

  Easy Language Switcher

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Language Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Lemonade Social Networks Autoposter Pinterest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56028 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lemonadestudio Lemonade Social Networks Autoposter Pinterest lemonade-sna-pinterest-edition allows Reflected XSS.This issue affects Lemonade Social Networks Autoposter Pinterest: from n/a through <= 2.0.

  Product

  Lemonade Social Networks Autoposter Pinterest

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Lemonade Social Networks Autoposter Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Leads CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56027 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bizswoop Leads CRM leads-crm allows Reflected XSS.This issue affects Leads CRM: from n/a through <= 2.0.13.

  Product

  Leads CRM

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update Leads CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Inline Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56019 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.

  Product

  Inline Footnotes

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Inline Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025AHAthat: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-12595 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

  Product

  AHAthat

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Dec 31, 2024Category Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56021 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibnuyahya Category Post Shortcode category-post-shortcode allows Stored XSS.This issue affects Category Post Shortcode: from n/a through <= 2.4.

  Product

  Category Post Shortcode

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Category Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024SvegliaT Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56020 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svegliadesign SvegliaT Buttons svegliat-buttons allows Stored XSS.This issue affects SvegliaT Buttons: from n/a through <= 1.3.0.

  Product

  SvegliaT Buttons

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update SvegliaT Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.0.7

  What to do

  Affects up to 6.0.7. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56062 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.987.

  Product

  Royal Elementor Addons

  Affected

  up to 1.3.987

  What to do

  Affects up to 1.3.987. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024WooCommerce PDF Vouchers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56265 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Reflected XSS.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.

  Product

  WooCommerce PDF Vouchers

  Fixed in

  4.9.9

  What to do

  Update WooCommerce PDF Vouchers to 4.9.9 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Embed PDF Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56256 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer.This issue affects Embed PDF Viewer: from n/a through <= 2.3.1.

  Product

  Embed PDF Viewer

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Coupon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56235 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicky Kumar Coupon coupon-lite allows DOM-Based XSS.This issue affects Coupon: from n/a through <= 1.2.2.

  Product

  Coupon

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024KinTPV WooConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56233 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinhelios KinTPV WooConnect kintpv-connect allows Stored XSS.This issue affects KinTPV WooConnect: from n/a through <= 8.129.

  Product

  KinTPV WooConnect

  Affected

  up to 8.129

  What to do

  Affects up to 8.129. Update KinTPV WooConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024SaasPricing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56231 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio SaasPricing saaspricing allows DOM-Based XSS.This issue affects SaasPricing: from n/a through <= 1.2.4.

  Product

  SaasPricing

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update SaasPricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56228 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through <= 3.1.2.

  Product

  Wishlist for WooCommerce

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56226 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Reflected XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.

  Product

  Royal Elementor Addons

  Affected

  up to 1.7.1001

  What to do

  Affects up to 1.7.1001. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Ledenbeheer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56224 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ledenbeheer Ledenbeheer ledenbeheer-external-connection allows Stored XSS.This issue affects Ledenbeheer: from n/a through <= 2.1.0.

  Product

  Ledenbeheer

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Ledenbeheer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Gulri Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56223 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Gulri Slider gulri-slider allows Reflected XSS.This issue affects Gulri Slider: from n/a through <= 3.5.8.

  Product

  Gulri Slider

  Affected

  up to 3.5.8

  What to do

  Affects up to 3.5.8. Update Gulri Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024WPMozo Addons Lite for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56221 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows Stored XSS.This issue affects WPMozo Addons Lite for Elementor: from n/a through <= 1.2.0.

  Product

  WPMozo Addons Lite for Elementor

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update WPMozo Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Userpro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56210 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Userpro userpro allows Reflected XSS.This issue affects Userpro: from n/a through <= 5.1.9.

  Product

  Userpro

  Affected

  up to 5.1.9

  What to do

  Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Kleo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56209 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue affects Kleo: from n/a through < 5.4.4.

  Product

  Kleo

  What to do

  Update Kleo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 19, 2024Fusion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37962 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion.This issue affects Fusion: from n/a through <= 1.6.1.

  Product

  Fusion

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Fusion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Image Mapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56016 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected XSS.This issue affects Image Mapper: from n/a through <= 0.2.5.3.

  Product

  Image Mapper

  Affected

  up to 0.2.5.3

  What to do

  Affects up to 0.2.5.3. Update Image Mapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Device Detector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56010 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Device Detector device-detector allows Reflected XSS.This issue affects Device Detector: from n/a through <= 4.2.0.

  Product

  Device Detector

  Affected

  up to 4.2.0

  What to do

  Affects up to 4.2.0. Update Device Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024hmd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54350 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: from n/a through <= 2.0.

  Product

  hmd

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update hmd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Saoshyant Element: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows Reflected XSS.This issue affects Saoshyant Element: from n/a through <= 1.2.

  Product

  Saoshyant Element

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Saoshyant Element to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Bootstrap Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49677 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons bootstrap-buttons allows Reflected XSS.This issue affects Bootstrap Buttons: from n/a through <= 1.2.

  Product

  Bootstrap Buttons

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Bootstrap Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Brand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54348 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affects Brand: from n/a through <= 1.1.6.

  Product

  Brand

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024tydskrif: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54257 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molefed allows Reflected XSS.This issue affects tydskrif: from n/a through 1.1.3.

  Product

  tydskrif

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update tydskrif to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Advanced Options Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54249 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS.This issue affects Advanced Options Editor: from n/a through 1.0.

  Product

  Advanced Options Editor

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Advanced Options Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Responsive Google Maps | by imbaa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56011 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-google-maps allows Stored XSS.This issue affects Responsive Google Maps | by imbaa: from n/a through <= 1.2.5.

  Product

  Responsive Google Maps | by imbaa

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Responsive Google Maps | by imbaa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Advanced Data Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54443 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.

  Product

  Advanced Data Table For Elementor

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Advanced Data Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Better WP Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54442 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better-wp-login-page allows Stored XSS.This issue affects Better WP Login Page: from n/a through <= 1.1.2.

  Product

  Better WP Login Page

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Better WP Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Utech World Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54441 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.

  Product

  Utech World Time

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Utech World Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024jCarousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54437 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in koolkatwebdesigns jCarousel jcarousel-for-wordpress allows Stored XSS.This issue affects jCarousel: from n/a through <= 1.0.

  Product

  jCarousel

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update jCarousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Like in Vk.com: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilya_compman Like in Vk.com like-on-vkontakte allows Stored XSS.This issue affects Like in Vk.com: from n/a through <= 0.5.2.

  Product

  Like in Vk.com

  Affected

  up to 0.5.2

  What to do

  Affects up to 0.5.2. Update Like in Vk.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Evernote Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54422 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tgw365 Evernote Sync evernote-sync allows Reflected XSS.This issue affects Evernote Sync: from n/a through <= 3.0.0.

  Product

  Evernote Sync

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Evernote Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Comments On Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54406 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moallemi Comments On Feed comments-on-feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through <= 1.2.1.

  Product

  Comments On Feed

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Comments On Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Visual Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54403 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oktoberfive Visual Recent Posts visual-recent-posts allows Reflected XSS.This issue affects Visual Recent Posts: from n/a through <= 1.2.3.

  Product

  Visual Recent Posts

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Visual Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Increase Sociability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preblogging Increase Sociability increase-sociability allows Reflected XSS.This issue affects Increase Sociability: from n/a through <= 1.3.0.

  Product

  Increase Sociability

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Increase Sociability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024TagGator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54390 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected XSS.This issue affects TagGator: from n/a through <= 1.54.

  Product

  TagGator

  Affected

  up to 1.54

  What to do

  Affects up to 1.54. Update TagGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Posts Date Ranges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54387 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaytesh Barange Posts Date Ranges posts-date-ranges allows Reflected XSS.This issue affects Posts Date Ranges: from n/a through <= 2.2.

  Product

  Posts Date Ranges

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Posts Date Ranges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Feedpress Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54364 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spartac Feedpress Generator feedpress-generator allows Reflected XSS.This issue affects Feedpress Generator: from n/a through <= 1.2.1.

  Product

  Feedpress Generator

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Feedpress Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2024Gutensee: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54360 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in premila Gutensee gutensee allows DOM-Based XSS.This issue affects Gutensee: from n/a through <= 1.0.6.

  Product

  Gutensee

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Gutensee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 20243D Avatar User Profile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54358 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through <= 1.0.0.

  Product

  3D Avatar User Profile

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update 3D Avatar User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Plain Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54349 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mashiurz Plain Post plain-post allows Stored XSS.This issue affects Plain Post: from n/a through <= 1.0.3.

  Product

  Plain Post

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Plain Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024FloristPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54347 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Reflected XSS.This issue affects FloristPress: from n/a through <= 7.2.0.

  Product

  FloristPress

  Affected

  up to 7.2.0

  What to do

  Affects up to 7.2.0. Update FloristPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Barter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54346 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Barter barter allows DOM-Based XSS.This issue affects Barter: from n/a through <= 1.6.

  Product

  Barter

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Barter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Bicycleshop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54345 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Bicycleshop bicycleshop allows DOM-Based XSS.This issue affects Bicycleshop: from n/a through <= 1.5.

  Product

  Bicycleshop

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Bicycleshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024WP Quick Shop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54344 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Quick Shop wp-quick-shop allows Reflected XSS.This issue affects WP Quick Shop: from n/a through <= 1.3.1.

  Product

  WP Quick Shop

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update WP Quick Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.