Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 8 of 39
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.9.0
- What to do
- Update Page Builder: Pagelayer to 1.9.0 or newer.
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.3.1
- What to do
- Update Everest Forms to 3.0.3.1 or newer.
May 15, 2025Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-8493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Events Calendar
- Fixed in
- 6.6.4
- What to do
- Update Events Calendar to 6.6.4 or newer.
May 15, 2025Hustle: Does not sanitise and escape some of its settingsCVE-2024-8492 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Hustle
- Affected
- up to 7.8.5
- What to do
- Affects up to 7.8.5. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.8
- What to do
- Update Page Builder: Pagelayer to 1.8.8 or newer.
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Download Manager
- Fixed in
- 3.2.99
- What to do
- Update Download Manager to 3.2.99 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Post Show
- Fixed in
- 3.0.1
- What to do
- Update Smart Post Show to 3.0.1 or newer.
May 15, 2025Ntz Antispam: Does not have CSRF check in placeCVE-2024-8094 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Ntz Antispam
- Affected
- up to 2.0e
- What to do
- Affects up to 2.0e. Update Ntz Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025ClickSold IDX: Does not sanitise and escape some of its settingsCVE-2024-7769 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- ClickSold IDX
- Affected
- up to 1.90
- What to do
- Affects up to 1.90. Update ClickSold IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PWA for WP: Does not sanitise and escape some of its settingsCVE-2024-7759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- PWA for WP
- Fixed in
- 1.7.72
- What to do
- Update PWA for WP to 1.7.72 or newer.
May 15, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-7758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Stylish Price List
- Fixed in
- 7.1.8
- What to do
- Update Stylish Price List to 7.1.8 or newer.
May 15, 2025Simple Share: Does not sanitise and escape some of its settingsCVE-2024-7556 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Share
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Simple Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Simple Video Directory
- Fixed in
- 1.4.3
- What to do
- Update Simple Video Directory to 1.4.3 or newer.
May 15, 2025DL Verification: Does not sanitise and escape some of its settingsCVE-2024-6798 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025DL Robots.txt: Does not sanitise and escape some of its settingsCVE-2024-6797 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Robots.txt
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Robots.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PVN Auth Popup: Does not sanitise and escape some of its settingsCVE-2024-6713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Event Tickets with Ticket Scanner: Does not sanitise and escape some parametersCVE-2024-6711 · WordPress plugins & themes · reported by WPScanLow 3.5
The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.3.8
- What to do
- Update Event Tickets with Ticket Scanner to 2.3.8 or newer.
May 15, 2025User Profile Builder: Does not sanitise and escape some parameters before outputting its content on the admin areaCVE-2024-6708 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
- Product
- User Profile Builder
- Fixed in
- 3.12.2
- What to do
- Update User Profile Builder to 3.12.2 or newer.
May 15, 2025wccp-pro: Does not sanitise and escape some of its settingsCVE-2024-6693 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- wccp-pro
- Fixed in
- 15.3
- What to do
- Update wccp-pro to 15.3 or newer.
May 15, 2025ProfilePro: Does not sanitise and escape some parameters and lacks proper access controlsCVE-2024-6668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks
- Product
- ProfilePro
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ProfilePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6667 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin.
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.5
- What to do
- Update KBucket: Your Curated Content in to 4.1.5 or newer.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape some of its settingsCVE-2024-6665 · WordPress plugins & themes · reported by WPScanMedium 4.8
The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.6
- What to do
- Update KBucket: Your Curated Content in to 4.1.6 or newer.
May 15, 2025CTT Expresso para WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-6478 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CTT Expresso para WooCommerce
- Fixed in
- 3.2.13
- What to do
- Update CTT Expresso para WooCommerce to 3.2.13 or newer.
May 15, 2025DL Yandex Metrika: Does not sanitise and escape some of its settingsCVE-2024-6462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DL Yandex Metrika
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Yandex Metrika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Tracking Code Manager: Does not sanitise and escape some of its settingsCVE-2024-6335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tracking Code Manager
- Fixed in
- 2.3.0
- What to do
- Update Tracking Code Manager to 2.3.0 or newer.
May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Push Notification for Post and BuddyPress
- Fixed in
- 1.9.4
- What to do
- Update Push Notification for Post and BuddyPress to 1.9.4 or newer.
May 15, 2025CM Tooltip Glossary: Does not sanitise and escape some of its settingsCVE-2024-5026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CM Tooltip Glossary
- Fixed in
- 4.3.4
- What to do
- Update CM Tooltip Glossary to 4.3.4 or newer.
May 15, 2025Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-4091 · WordPress plugins & themes · reported by WPScanLow 3.5
The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.15
- What to do
- Update Responsive Gallery Grid to 2.3.15 or newer.
May 15, 2025Advanced Cron Manager: Does not sanitise and escape some of its settingsCVE-2024-4004 · WordPress plugins & themes · reported by WPScanLow 3.5
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Cron Manager
- Fixed in
- 2.5.7
- What to do
- Update Advanced Cron Manager to 2.5.7 or newer.
May 15, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-4002 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.6.9
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.6.9 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-3996 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Post Show
- Fixed in
- 2.4.28
- What to do
- Update Smart Post Show to 2.4.28 or newer.
May 15, 2025Save as Image Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2024-3062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as Image Plugin by Pdfcrowd
- Fixed in
- 3.2.2
- What to do
- Update Save as Image Plugin by Pdfcrowd to 3.2.2 or newer.
May 15, 2025Easy Property Listings: Does not sanitise and escape some of its settingsCVE-2024-2869 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
May 15, 2025Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-2643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.6.8
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.6.8 or newer.
May 15, 2025Ultimate Noindex Nofollow Tool II: Does not sanitise and escape some of its settingsCVE-2024-1663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Noindex Nofollow Tool II
- Fixed in
- 1.3.6
- What to do
- Update Ultimate Noindex Nofollow Tool II to 1.3.6 or newer.
May 15, 2025S3Player: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13865 · WordPress plugins & themes · reported by WPScanMedium 6.1
The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- S3Player
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update S3Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Badgearoo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13828 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025360 Product Rotation: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13823 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- 360 Product Rotation
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update 360 Product Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13730 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.2.1
- What to do
- Update Podlove Podcast Publisher to 4.2.1 or newer.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13729 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.1.24
- What to do
- Update Podlove Podcast Publisher to 4.1.24 or newer.
May 15, 2025MemberSpace: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13727 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- MemberSpace
- Fixed in
- 2.1.14
- What to do
- Update MemberSpace to 2.1.14 or newer.
May 15, 2025GDPR Framework By Data443: Does not sanitise and escape some of its settingsCVE-2024-13621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Framework By Data443
- Fixed in
- 2.2.0
- What to do
- Update GDPR Framework By Data443 to 2.2.0 or newer.
May 15, 2025LifterLMS: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- LifterLMS
- Fixed in
- 8.0.1
- What to do
- Update LifterLMS to 8.0.1 or newer.
May 15, 2025VikBooking Hotel Booking Engine & PMS: Does not sanitise and escape some of its settingsCVE-2024-13616 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.7.2
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.7.2 or newer.
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13486 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-13384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.24
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.24 or newer.
May 15, 2025HD Quiz: Does not sanitise and escape some of its settingsCVE-2024-13383 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- HD Quiz
- Fixed in
- 2.0.0
- What to do
- Update HD Quiz to 2.0.0 or newer.
May 15, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13382 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.64
- What to do
- Update Calculated Fields Form to 5.2.64 or newer.
May 15, 2025Ditty: Does not sanitise and escape some of its settingsCVE-2024-13357 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ditty
- Fixed in
- 3.1.52
- What to do
- Update Ditty to 3.1.52 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.