Vulnerability database

6,573 results · page 80 of 132

• Jan 2, 2025Themify Audio Dock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56239 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.4.

  Product

  Themify Audio Dock

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Themify Audio Dock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56237 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 24.0.3.

  Product

  Contest Gallery

  Affected

  up to 24.0.3

  What to do

  Affects up to 24.0.3. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Simple Proxy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56026 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg – SiteOrigin Simple Proxy simple-proxy allows Reflected XSS.This issue affects Simple Proxy: from n/a through <= 1.0.

  Product

  Simple Proxy

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Simple Proxy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025AdWork Media EZ Content Locker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56025 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adworkmedia AdWork Media EZ Content Locker adwork-media-ez-content-locker allows Reflected XSS.This issue affects AdWork Media EZ Content Locker: from n/a through <= 3.0.

  Product

  AdWork Media EZ Content Locker

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update AdWork Media EZ Content Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56024 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Reflected XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.

  Product

  Custom Dashboard Widget

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WP eCommerce Quickpay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56023 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PerfectSolution WP eCommerce Quickpay wp-ecommerce-quickpay allows Reflected XSS.This issue affects WP eCommerce Quickpay: from n/a through <= 1.1.0.

  Product

  WP eCommerce Quickpay

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WP eCommerce Quickpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Preloader by WordPress Monsters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56022 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress Monsters Preloader by WordPress Monsters preloader-sws allows Reflected XSS.This issue affects Preloader by WordPress Monsters: from n/a through <= 1.2.3.

  Product

  Preloader by WordPress Monsters

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Preloader by WordPress Monsters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025BU Section Editing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56018 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Section Editing bu-section-editing allows Reflected XSS.This issue affects BU Section Editing: from n/a through <= 0.9.9.

  Product

  BU Section Editing

  Affected

  up to 0.9.9

  What to do

  Affects up to 0.9.9. Update BU Section Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025WP SuperBackup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Reflected XSS.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

  Product

  WP SuperBackup

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Reflected XSS.This issue affects HTML Forms: from n/a through <= 1.4.1.

  Product

  HTML Forms

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025SendSMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56038 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catalinsendsms SendSMS sendsms allows Reflected XSS.This issue affects SendSMS: from n/a through <= 1.2.9.

  Product

  SendSMS

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update SendSMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025User Referral: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftClever Limited User Referral user-referral-free allows Reflected XSS.This issue affects User Referral: from n/a through <= 8.0.

  Product

  User Referral

  Affected

  up to 8.0

  What to do

  Affects up to 8.0. Update User Referral to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025odPhotogallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56036 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ondrej Donek odPhotogallery od-photogallery-plugin allows Reflected XSS.This issue affects odPhotogallery: from n/a through <= 0.5.3.

  Product

  odPhotogallery

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update odPhotogallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Upload Scanner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56035 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner upload-scanner allows Reflected XSS.This issue affects Upload Scanner: from n/a through <= 1.2.

  Product

  Upload Scanner

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Upload Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Services updates for customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56034 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Services updates for customers service-updates-for-customers allows Reflected XSS.This issue affects Services updates for customers: from n/a through <= 1.0.

  Product

  Services updates for customers

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Services updates for customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56033 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Reflected XSS.This issue affects FAQs: from n/a through <= 1.0.2.

  Product

  FAQs

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025FV Descriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56032 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Descriptions fv-descriptions allows Reflected XSS.This issue affects FV Descriptions: from n/a through <= 1.4.

  Product

  FV Descriptions

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update FV Descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 202510CentMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56030 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carver Lab 10CentMail 10centmail-subscription-management-and-analytics allows Reflected XSS.This issue affects 10CentMail: from n/a through <= 2.1.50.

  Product

  10CentMail

  Affected

  up to 2.1.50

  What to do

  Affects up to 2.1.50. Update 10CentMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Easy Language Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamwinner Easy Language Switcher easy-language-switcher allows Reflected XSS.This issue affects Easy Language Switcher: from n/a through <= 1.0.

  Product

  Easy Language Switcher

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Language Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Lemonade Social Networks Autoposter Pinterest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56028 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lemonadestudio Lemonade Social Networks Autoposter Pinterest lemonade-sna-pinterest-edition allows Reflected XSS.This issue affects Lemonade Social Networks Autoposter Pinterest: from n/a through <= 2.0.

  Product

  Lemonade Social Networks Autoposter Pinterest

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Lemonade Social Networks Autoposter Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Leads CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56027 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bizswoop Leads CRM leads-crm allows Reflected XSS.This issue affects Leads CRM: from n/a through <= 2.0.13.

  Product

  Leads CRM

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update Leads CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 2, 2025Inline Footnotes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56019 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.

  Product

  Inline Footnotes

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Inline Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Category Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56021 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibnuyahya Category Post Shortcode category-post-shortcode allows Stored XSS.This issue affects Category Post Shortcode: from n/a through <= 2.4.

  Product

  Category Post Shortcode

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Category Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024SvegliaT Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56020 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svegliadesign SvegliaT Buttons svegliat-buttons allows Stored XSS.This issue affects SvegliaT Buttons: from n/a through <= 1.3.0.

  Product

  SvegliaT Buttons

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update SvegliaT Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.0.7

  What to do

  Affects up to 6.0.7. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56062 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.987.

  Product

  Royal Elementor Addons

  Affected

  up to 1.3.987

  What to do

  Affects up to 1.3.987. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024WooCommerce PDF Vouchers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56265 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Reflected XSS.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.

  Product

  WooCommerce PDF Vouchers

  Fixed in

  4.9.9

  What to do

  Update WooCommerce PDF Vouchers to 4.9.9 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Embed PDF Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56256 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer.This issue affects Embed PDF Viewer: from n/a through <= 2.3.1.

  Product

  Embed PDF Viewer

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Coupon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56235 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicky Kumar Coupon coupon-lite allows DOM-Based XSS.This issue affects Coupon: from n/a through <= 1.2.2.

  Product

  Coupon

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024KinTPV WooConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56233 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinhelios KinTPV WooConnect kintpv-connect allows Stored XSS.This issue affects KinTPV WooConnect: from n/a through <= 8.129.

  Product

  KinTPV WooConnect

  Affected

  up to 8.129

  What to do

  Affects up to 8.129. Update KinTPV WooConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024SaasPricing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56231 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio SaasPricing saaspricing allows DOM-Based XSS.This issue affects SaasPricing: from n/a through <= 1.2.4.

  Product

  SaasPricing

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update SaasPricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56228 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through <= 3.1.2.

  Product

  Wishlist for WooCommerce

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56226 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Reflected XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.

  Product

  Royal Elementor Addons

  Affected

  up to 1.7.1001

  What to do

  Affects up to 1.7.1001. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Ledenbeheer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56224 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ledenbeheer Ledenbeheer ledenbeheer-external-connection allows Stored XSS.This issue affects Ledenbeheer: from n/a through <= 2.1.0.

  Product

  Ledenbeheer

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Ledenbeheer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Gulri Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56223 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Gulri Slider gulri-slider allows Reflected XSS.This issue affects Gulri Slider: from n/a through <= 3.5.8.

  Product

  Gulri Slider

  Affected

  up to 3.5.8

  What to do

  Affects up to 3.5.8. Update Gulri Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024WPMozo Addons Lite for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56221 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows Stored XSS.This issue affects WPMozo Addons Lite for Elementor: from n/a through <= 1.2.0.

  Product

  WPMozo Addons Lite for Elementor

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update WPMozo Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Userpro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56210 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Userpro userpro allows Reflected XSS.This issue affects Userpro: from n/a through <= 5.1.9.

  Product

  Userpro

  Affected

  up to 5.1.9

  What to do

  Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2024Kleo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56209 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue affects Kleo: from n/a through < 5.4.4.

  Product

  Kleo

  What to do

  Update Kleo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2024WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor: Local File InclusionCVE-2024-12272 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

  Product

  WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 23, 2024A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress.CVE-2018-25106 · WordPress plugins & themes · reported by VulDBMedium 5.3

  A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.

  Product

  webuidesigning NebulaX

  Affected

  up to 5.0

  What to do

  Affects up to 5.0. Update webuidesigning NebulaX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comvuldb.com

• Dec 21, 2024Elementor Website Builder – More than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-10453 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Settings in all versions up to, and including, 3.25.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Elementor Website Builder – More than Just a Page Builder

  Affected

  up to 3.25.9

  What to do

  Affects up to 3.25.9. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 21, 2024G Web Pro Store Locator: Reflected Cross-Site ScriptingCVE-2024-11682 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  G Web Pro Store Locator

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update G Web Pro Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 20, 2024Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2024-11811 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'platform', 'phone', 'email', and 'store_url' parameters. in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Feedify – Web Push Notifications

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 19, 2024Fusion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37962 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion.This issue affects Fusion: from n/a through <= 1.6.1.

  Product

  Fusion

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Fusion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 19, 2024AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Reflected Cross-Site ScriptingCVE-2024-12626 · WordPress plugins & themes · reported by WordfenceCritical 9.6

  The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code.

  Product

  AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in

  Affected

  up to 5.0.9

  What to do

  Affects up to 5.0.9. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 18, 2024Image Mapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56016 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected XSS.This issue affects Image Mapper: from n/a through <= 0.2.5.3.

  Product

  Image Mapper

  Affected

  up to 0.2.5.3

  What to do

  Affects up to 0.2.5.3. Update Image Mapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Device Detector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56010 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Device Detector device-detector allows Reflected XSS.This issue affects Device Detector: from n/a through <= 4.2.0.

  Product

  Device Detector

  Affected

  up to 4.2.0

  What to do

  Affects up to 4.2.0. Update Device Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024hmd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54350 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: from n/a through <= 2.0.

  Product

  hmd

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update hmd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Saoshyant Element: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51646 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows Reflected XSS.This issue affects Saoshyant Element: from n/a through <= 1.2.

  Product

  Saoshyant Element

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Saoshyant Element to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2024Bootstrap Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49677 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons bootstrap-buttons allows Reflected XSS.This issue affects Bootstrap Buttons: from n/a through <= 1.2.

  Product

  Bootstrap Buttons

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Bootstrap Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.