Vulnerability database

5,859 results · page 79 of 118

• Nov 19, 2024Sell Media File with Stripe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51892 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Sell Media File with Stripe sell-media-file allows Stored XSS.This issue affects Sell Media File with Stripe: from n/a through <= 1.0.6.

  Product

  Sell Media File with Stripe

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Sell Media File with Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Official SalesWizard CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51891 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SalesWizard.pl Official SalesWizard CRM Plugin official-saleswizard-crm allows Stored XSS.This issue affects Official SalesWizard CRM Plugin: from n/a through <= 1.0.3.

  Product

  Official SalesWizard CRM

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Official SalesWizard CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Geoportail Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51890 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geoWP Geoportail Shortcode geoportail-shortcode allows Stored XSS.This issue affects Geoportail Shortcode: from n/a through <= 2.4.4.

  Product

  Geoportail Shortcode

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Geoportail Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Fancy User List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51889 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeroNikolov Fancy User List fancy-user-listing allows Stored XSS.This issue affects Fancy User List: from n/a through <= 3.1.

  Product

  Fancy User List

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Fancy User List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024NV Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51887 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ryscript NV Slider nv-slider allows Stored XSS.This issue affects NV Slider: from n/a through <= 1.6.

  Product

  NV Slider

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update NV Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Posts Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51886 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama Posts Filter posts-filter allows Stored XSS.This issue affects Posts Filter: from n/a through <= 1.3.1.

  Product

  Posts Filter

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Posts Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Browsing History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51885 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama Browsing History browsing-history allows Stored XSS.This issue affects Browsing History: from n/a through <= 1.3.1.

  Product

  Browsing History

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Browsing History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Posts Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51884 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama Posts Search posts-search allows Stored XSS.This issue affects Posts Search: from n/a through <= 1.2.2.

  Product

  Posts Search

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Posts Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024I Plant A Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51883 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through <= 1.7.4.

  Product

  I Plant A Tree

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update I Plant A Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Be Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51881 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beautimour Be Shortcodes be-shortcodes allows DOM-Based XSS.This issue affects Be Shortcodes: from n/a through <= 1.0.0.

  Product

  Be Shortcodes

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Be Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024BeBetter Social Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51880 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sistemasBebetter BeBetter Social Icons bebetter-social-icons allows DOM-Based XSS.This issue affects BeBetter Social Icons: from n/a through <= 2.7.

  Product

  BeBetter Social Icons

  Affected

  up to 2.7

  What to do

  Affects up to 2.7. Update BeBetter Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Text Advertisements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51879 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arash Heidari Text Advertisements text-advertisements allows Stored XSS.This issue affects Text Advertisements: from n/a through <= 2.1.

  Product

  Text Advertisements

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Text Advertisements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024AchillesTheme-shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51878 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in strailejoey AchillesTheme-shortcodes achilles-shortcodes allows DOM-Based XSS.This issue affects AchillesTheme-shortcodes: from n/a through <= 0.1.

  Product

  AchillesTheme-shortcodes

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update AchillesTheme-shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024SV Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51877 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in straightvisions GmbH SV Forms sv-forms allows DOM-Based XSS.This issue affects SV Forms: from n/a through <= 2.0.05.

  Product

  SV Forms

  Affected

  up to 2.0.05

  What to do

  Affects up to 2.0.05. Update SV Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024wp_automatic_widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51876 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codstack wp_automatic_widget wp-automatic-widget allows DOM-Based XSS.This issue affects wp_automatic_widget: from n/a through <= 1.0.1.

  Product

  wp_automatic_widget

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update wp_automatic_widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024MDC YouTube Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51875 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmul Ahsan MDC YouTube Downloader mdc-youtube-downloader allows DOM-Based XSS.This issue affects MDC YouTube Downloader: from n/a through <= 3.0.0.

  Product

  MDC YouTube Downloader

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update MDC YouTube Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024ParOne Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51874 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ParOne, Inc ParOne Feeds parone allows DOM-Based XSS.This issue affects ParOne Feeds: from n/a through <= 1.17.1.

  Product

  ParOne Feeds

  Affected

  up to 1.17.1

  What to do

  Affects up to 1.17.1. Update ParOne Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Multi-day Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51873 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masashi Takizawa Multi-day Booking Calendar multi-day-booking-calendar allows DOM-Based XSS.This issue affects Multi-day Booking Calendar: from n/a through <= 1.0.1.

  Product

  Multi-day Booking Calendar

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Multi-day Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Luzuk Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51872 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in luzuk Themes Luzuk Testimonials luzuk-testimonials allows Stored XSS.This issue affects Luzuk Testimonials: from n/a through <= 0.0.1.

  Product

  Luzuk Testimonials

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update Luzuk Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Luzuk Team: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51871 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in luzuk Themes Luzuk Team luzuk-team allows Stored XSS.This issue affects Luzuk Team: from n/a through <= 0.1.0.

  Product

  Luzuk Team

  Affected

  up to 0.1.0

  What to do

  Affects up to 0.1.0. Update Luzuk Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Ultimate Flipbox Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dragwyb Ultimate Flipbox Addon for Elementor ultimate-flipbox-addon-for-elementor allows Stored XSS.This issue affects Ultimate Flipbox Addon for Elementor: from n/a through 1.0.4.

  Product

  Ultimate Flipbox Addon for Elementor

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Ultimate Flipbox Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Gutenium Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51869 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Gutenium Blocks gutenium allows Stored XSS.This issue affects Gutenium Blocks: from n/a through <= 1.1.7.

  Product

  Gutenium Blocks

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Gutenium Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024DuoGeek Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51868 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tapan Kumer Das DuoGeek Blocks duogeek-blocks allows Stored XSS.This issue affects DuoGeek Blocks: from n/a through 0.1.1.

  Product

  DuoGeek Blocks

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update DuoGeek Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Simpul Events by Esotech: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51867 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geilt Simpul Events by Esotech simpul-events-by-esotech allows Stored XSS.This issue affects Simpul Events by Esotech: from n/a through <= 1.8.5.

  Product

  Simpul Events by Esotech

  Affected

  up to 1.8.5

  What to do

  Affects up to 1.8.5. Update Simpul Events by Esotech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Social button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51866 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riponshah Social button social-button allows Stored XSS.This issue affects Social button: from n/a through <= 1.3.

  Product

  Social button

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Social button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Simple Social Share Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51865 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leroysabrina Simple Social Share Block simple-social-share-block allows Stored XSS.This issue affects Simple Social Share Block: from n/a through <= 1.0.0.

  Product

  Simple Social Share Block

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Simple Social Share Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Shortcode Collection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51864 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agnel Waghela Shortcode Collection shortcode-collection allows Stored XSS.This issue affects Shortcode Collection: from n/a through <= 1.4.

  Product

  Shortcode Collection

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Shortcode Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024PF Timer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51863 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Profit Funnels PF Timer pf-timer allows Stored XSS.This issue affects PF Timer: from n/a through <= 1.0.0.

  Product

  PF Timer

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update PF Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Google Visualization Charts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51862 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Wicht Google Visualization Charts google-visualization-charts allows Stored XSS.This issue affects Google Visualization Charts: from n/a through <= 0.1.

  Product

  Google Visualization Charts

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Google Visualization Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024EventPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51861 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek EventPress wp-eventpress allows Stored XSS.This issue affects EventPress: from n/a through <= 1.0.0.

  Product

  EventPress

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update EventPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51860 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Stored XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.

  Product

  Custom Dashboard Widget

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Bamboo Enquiries: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51859 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Manchester Bamboo Enquiries bamboo-enquiries allows Stored XSS.This issue affects Bamboo Enquiries: from n/a through <= 1.9.3.

  Product

  Bamboo Enquiries

  Affected

  up to 1.9.3

  What to do

  Affects up to 1.9.3. Update Bamboo Enquiries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Social Locker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51858 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Social Locker social-locker-content allows Stored XSS.This issue affects Social Locker: from n/a through <= 1.1.

  Product

  Social Locker

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Olympus Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51857 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DannyCooper Olympus Shortcodes olympus-shortcodes allows DOM-Based XSS.This issue affects Olympus Shortcodes: from n/a through <= 1.0.4.

  Product

  Olympus Shortcodes

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Olympus Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Moose Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51856 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibllex Moose Elementor Kit moose-elementor-kit allows DOM-Based XSS.This issue affects Moose Elementor Kit: from n/a through <= 1.0.0.

  Product

  Moose Elementor Kit

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Moose Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Redirecter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51855 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Productineer Redirecter shortcode-for-redirection allows DOM-Based XSS.This issue affects Redirecter: from n/a through <= 1.0.

  Product

  Redirecter

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Redirecter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Hola Free Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51854 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in holanetworks Hola Free Video Player hola-free-video-player allows DOM-Based XSS.This issue affects Hola Free Video Player: from n/a through <= 1.3.9.

  Product

  Hola Free Video Player

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Hola Free Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Faltu Testimonial Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51853 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberuni Azad. Faltu Testimonial Rotator faltu-testimonial-rotator allows DOM-Based XSS.This issue affects Faltu Testimonial Rotator: from n/a through <= 1.0.0.

  Product

  Faltu Testimonial Rotator

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Faltu Testimonial Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Dynamic Post Grid Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51852 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maidul Dynamic Post Grid Elementor Addon dynamic-post-grid-elementor-addon allows DOM-Based XSS.This issue affects Dynamic Post Grid Elementor Addon: from n/a through <= 1.0.6.

  Product

  Dynamic Post Grid Elementor Addon

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Dynamic Post Grid Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024best bootstrap widgets for elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51851 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salehattari best bootstrap widgets for elementor best-bootstrap-widgets-for-elementor allows DOM-Based XSS.This issue affects best bootstrap widgets for elementor: from n/a through <= 1.0.

  Product

  best bootstrap widgets for elementor

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update best bootstrap widgets for elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WoW Guild Armory Roster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51850 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bchristopeit WoW Guild Armory Roster guild-armory-roster allows Stored XSS.This issue affects WoW Guild Armory Roster: from n/a through <= 0.5.5.

  Product

  WoW Guild Armory Roster

  Affected

  up to 0.5.5

  What to do

  Affects up to 0.5.5. Update WoW Guild Armory Roster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024My Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51849 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Piarulli My Restaurant Menu my-restaurant-menu allows Stored XSS.This issue affects My Restaurant Menu: from n/a through <= 0.2.0.

  Product

  My Restaurant Menu

  Affected

  up to 0.2.0

  What to do

  Affects up to 0.2.0. Update My Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Parallaxer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51848 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Parallaxer parallaxer-lite-parallax-effects-on-images allows Stored XSS.This issue affects Parallaxer: from n/a through <= 1.00.

  Product

  Parallaxer

  Affected

  up to 1.00

  What to do

  Affects up to 1.00. Update Parallaxer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024WP PagSeguro Payments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51847 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in giovanebribeiro WP PagSeguro Payments wp-pagseguro-payments allows Stored XSS.This issue affects WP PagSeguro Payments: from n/a through <= 1.0.

  Product

  WP PagSeguro Payments

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP PagSeguro Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Community Yard Sale: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51846 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Simpson Community Yard Sale community-yard-sale allows Stored XSS.This issue affects Community Yard Sale: from n/a through <= 1.1.11.

  Product

  Community Yard Sale

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update Community Yard Sale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Location Click Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51844 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Patil Location Click Map location-click-map allows Stored XSS.This issue affects Location Click Map: from n/a through <= 1.0.

  Product

  Location Click Map

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Location Click Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Image Carousel Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51842 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Image Carousel Shortcode image-carousel-shortcode allows DOM-Based XSS.This issue affects Image Carousel Shortcode: from n/a through <= 1.2.

  Product

  Image Carousel Shortcode

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Image Carousel Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024File Select Control For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51841 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abdul Awal Uzzal File Select Control For Elementor file-select-control-for-elementor allows DOM-Based XSS.This issue affects File Select Control For Elementor: from n/a through <= 1.3.

  Product

  File Select Control For Elementor

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update File Select Control For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Wd-image-magnifier-xoss: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51840 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rezaul Wd-image-magnifier-xoss wd-image-magnifier-xoss allows DOM-Based XSS.This issue affects Wd-image-magnifier-xoss: from n/a through <= 1.0.

  Product

  Wd-image-magnifier-xoss

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Wd-image-magnifier-xoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Utech Spinning Earth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51839 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech Spinning Earth utech-spinning-earth allows DOM-Based XSS.This issue affects Utech Spinning Earth: from n/a through <= 1.2.

  Product

  Utech Spinning Earth

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Utech Spinning Earth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.