Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

979 results · page 8 of 20

Jan 7, 2025SEO Keywords: Reflected Cross-Site ScriptingCVE-2024-12126 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Keywords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘google_error’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEO Keywords
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update SEO Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025Woo Ukrposhta: Reflected Cross-Site ScriptingCVE-2024-12049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and including, 1.17.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Woo Ukrposhta
Affected
up to 1.17.11
What to do
Affects up to 1.17.11. Update Woo Ukrposhta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025PayGreen Payment Gateway: Reflected Cross-Site ScriptingCVE-2024-11810 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PayGreen Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message_id' parameter in all versions up to, and including, 1.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PayGreen Payment Gateway
Affected
up to 1.0.26
What to do
Affects up to 1.0.26. Update PayGreen Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025Financial Stocks & Crypto Market Data: Reflected Cross-Site ScriptingCVE-2024-11690 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Financial Stocks & Crypto Market Data
Affected
up to 1.10.3
What to do
Affects up to 1.10.3. Update Financial Stocks & Crypto Market Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025WP – Bulk SMS – by SMS.to: Reflected Cross-Site ScriptingCVE-2024-11434 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP – Bulk SMS – by SMS.to
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update WP – Bulk SMS – by SMS.to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Bizapp for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11378 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Bizapp for WooCommerce
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Bizapp for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Automate Hub Free by Sperse.IO: Reflected Cross-Site ScriptingCVE-2024-11377 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Automate Hub Free by Sperse.IO
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Automate Hub Free by Sperse.IO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025WC1C: Reflected Cross-Site ScriptingCVE-2024-11375 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WC1C plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.23.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WC1C
Affected
up to 0.23.0
What to do
Affects up to 0.23.0. Update WC1C to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Same but Different – Related Posts by Taxonomy: Reflected Cross-Site ScriptingCVE-2024-11363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Same but Different – Related Posts by Taxonomy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Same but Different – Related Posts by Taxonomy
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Same but Different – Related Posts by Taxonomy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 6, 2025ARS Affiliate Page: Reflected Cross-Site ScriptingCVE-2024-12098 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utm_keyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ARS Affiliate Page
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ARS Affiliate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025Turnkey bbPress by WeaverTheme: Reflected Cross-Site ScriptingCVE-2024-12221 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Turnkey bbPress by WeaverTheme
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Turnkey bbPress by WeaverTheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025WP Smart Import : Import any XML File to: Reflected Cross-Site ScriptingCVE-2024-12701 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Smart Import : Import any XML File to
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Smart Import : Import any XML File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025WP Compress – Instant Performance & Speed Optimization: Reflected Cross-Site ScriptingCVE-2024-12047 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Compress – Instant Performance & Speed Optimization
Affected
up to 6.30.03
What to do
Affects up to 6.30.03. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Media Library Assistant: Reflected Cross-Site ScriptingCVE-2024-11974 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Media Library Assistant
Affected
up to 3.23
What to do
Affects up to 3.23. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 1, 2025The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against higCVE-2024-11846 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Dec 24, 2024WP Datepicker: Reflected Cross-Site ScriptingCVE-2024-12468 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdp_get_selected_datepicker' parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Datepicker
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 24, 2024Export Customers Data: Reflected Cross-Site ScriptingCVE-2024-12405 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Export Customers Data
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Export Customers Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024Bitcoin Lightning Publisher for: Reflected Cross-Site ScriptingCVE-2024-12100 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Bitcoin Lightning Publisher for
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Bitcoin Lightning Publisher for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 24, 2024WP-Appbox: Reflected Cross-Site ScriptingCVE-2024-12710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP-Appbox
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP-Appbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024WP on AWS: Reflected Cross-Site ScriptingCVE-2024-12408 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST data in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP on AWS
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update WP on AWS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024LaTeX2HTML: Reflected Cross-Site ScriptingCVE-2024-11688 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
LaTeX2HTML
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update LaTeX2HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Pingmeter Uptime Monitoring: Reflected Cross-Site ScriptingCVE-2024-11808 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pingmeter Uptime Monitoring plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pingmeter Uptime Monitoring
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pingmeter Uptime Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024Ebook Store: Reflected Cross-Site ScriptingCVE-2024-12262 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ebook Store
Affected
up to 5.8001
What to do
Affects up to 5.8001. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 21, 2024Reactflow Visitor Recording and Heatmaps: Reflected Cross-Site ScriptingCVE-2024-11975 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Reactflow Visitor Recording and Heatmaps
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Reactflow Visitor Recording and Heatmaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024G Web Pro Store Locator: Reflected Cross-Site ScriptingCVE-2024-11682 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
G Web Pro Store Locator
Affected
up to 2.1
What to do
Affects up to 2.1. Update G Web Pro Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024Ebook Store: Reflected Cross-Site ScriptingCVE-2024-11287 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.8001. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ebook Store
Affected
up to 5.8001
What to do
Affects up to 5.8001. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2024-11811 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'platform', 'phone', 'email', and 'store_url' parameters. in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Feedify – Web Push Notifications
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2024PKT1 Centro de envios: Reflected Cross-Site ScriptingCVE-2024-11806 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PKT1 Centro de envios plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' and 'error' parameters in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PKT1 Centro de envios
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update PKT1 Centro de envios to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024استخراج محصولات ووکامرس برای آیسی: Reflected Cross-Site ScriptingCVE-2024-11331 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The استخراج محصولات ووکامرس برای آیسی plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
استخراج محصولات ووکامرس برای آیسی
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update استخراج محصولات ووکامرس برای آیسی to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2024AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Reflected Cross-Site ScriptingCVE-2024-12626 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code.
Product
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024AMP for WP – Accelerated Mobile Pages: Reflected Cross-Site ScriptingCVE-2024-11254 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024WooCommerce Additional Fees On Checkout (Free): Reflected Cross-Site ScriptingCVE-2024-12395 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WooCommerce Additional Fees On Checkout (Free)
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WooCommerce Additional Fees On Checkout (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024WP BASE Booking of Appointments, Services and Events: Reflected Cross-Site ScriptingCVE-2024-12469 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP BASE Booking of Appointments, Services and Events
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update WP BASE Booking of Appointments, Services and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 17, 2024Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS: Reflected Cross-Site ScriptingCVE-2024-12127 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS
Affected
up to 0.0.21
What to do
Affects up to 0.0.21. Update Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 16, 2024PowerPack Lite for Beaver Builder: Reflected Cross-Site ScriptingCVE-2024-12239 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, and including, 1.3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
PowerPack Lite for Beaver Builder
Affected
up to 1.3.0.5
What to do
Affects up to 1.3.0.5. Update PowerPack Lite for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Import Eventbrite Events: Reflected Cross-Site ScriptingCVE-2024-12422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Import Eventbrite Events
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Import Eventbrite Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2024Filestack Official: Reflected Cross-Site ScriptingCVE-2024-11462 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestack_options' parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Filestack Official
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Filestack Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024MyParcel: Reflected Cross-Site ScriptingCVE-2024-9608 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the WooCommerce store is set to Belgium.
Product
MyParcel
Affected
up to 4.24.1
What to do
Affects up to 4.24.1. Update MyParcel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024Primer MyData for Woocommerce: Reflected Cross-Site ScriptingCVE-2024-11809 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'img_src' parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Primer MyData for Woocommerce
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Primer MyData for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Seraphinite Bulk Discounts for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-12160 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Seraphinite Bulk Discounts for WooCommerce
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Seraphinite Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Analytics Cat – Google Analytics Made Easy: Reflected Cross-Site ScriptingCVE-2024-12072 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link. CVE-2025-24615 is likely a duplicate of this.
Product
Analytics Cat – Google Analytics Made Easy
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Analytics Cat – Google Analytics Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Library Bookshelves: Reflected Cross-Site ScriptingCVE-2024-11359 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Library Bookshelves plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Library Bookshelves
Affected
up to 5.8
What to do
Affects up to 5.8. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024BP Email Assign Templates: Reflected Cross-Site ScriptingCVE-2024-12441 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24631 is likely a duplicate of this.
Product
BP Email Assign Templates
Affected
up to 1.5
What to do
Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Video & Photo Gallery for Ultimate Member: Reflected Cross-Site ScriptingCVE-2024-12162 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024AI Content Writer, RSS Feed to Post, Autoblogging SEO Help: Reflected Cross-Site ScriptingCVE-2024-12156 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AI Content Writer, RSS Feed to Post, Autoblogging SEO Help
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update AI Content Writer, RSS Feed to Post, Autoblogging SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Planaday API: Reflected Cross-Site ScriptingCVE-2024-11804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Planaday API
Affected
up to 11.4
What to do
Affects up to 11.4. Update Planaday API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024kvCORE IDX: Reflected Cross-Site ScriptingCVE-2024-11723 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidx_listings_sitemap_ranges, kvcoreidx_listings_sitemap_page, kvcoreidx_agent_profile_sitemap, or kvcoreidx_agent_profile shortcode present in all versions up to, and including, 2.3.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
kvCORE IDX
Affected
up to 2.3.35
What to do
Affects up to 2.3.35. Update kvCORE IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Country Blocker: Reflected Cross-Site ScriptingCVE-2024-11459 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Country Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Country Blocker
Affected
up to 3.2
What to do
Affects up to 3.2. Update Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Website Toolbox Community: Reflected Cross-Site ScriptingCVE-2024-12338 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolbox_username’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Website Toolbox Community
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Website Toolbox Community to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Ultimate Endpoints With Rest Api: Reflected Cross-Site ScriptingCVE-2024-12260 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ultimate Endpoints With Rest Api
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Ultimate Endpoints With Rest Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.