Vulnerability database

6,573 results · page 82 of 132

• Dec 13, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54316 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows DOM-Based XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.8.

  Product

  Restaurant & Cafe Addon for Elementor

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Events Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54315 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.2.

  Product

  Events Addon for Elementor

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54314 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.6.0.

  Product

  Primary Addon for Elementor

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Persian Woocommerce SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54312 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.0.5.

  Product

  Persian Woocommerce SMS

  Affected

  up to 7.0.5

  What to do

  Affects up to 7.0.5. Update Persian Woocommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Cryptocurrency Price Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54308 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Cryptocurrency Price Widget cryptocurrency-price-widget allows Stored XSS.This issue affects Cryptocurrency Price Widget: from n/a through <= 1.2.3.

  Product

  Cryptocurrency Price Widget

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Cryptocurrency Price Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024J&T Express Malaysia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54305 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtexpress J&T Express Malaysia jt-express allows Reflected XSS.This issue affects J&T Express Malaysia: from n/a through <= 2.0.13.

  Product

  J&T Express Malaysia

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update J&T Express Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54303 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through <= 2.3.8.

  Product

  Simple Payment

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024VPSUForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54302 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.0.0.

  Product

  VPSUForm

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024FormFacade: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54301 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manidoraisamy FormFacade formfacade allows Reflected XSS.This issue affects FormFacade: from n/a through <= 1.3.6.

  Product

  FormFacade

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update FormFacade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Revi.io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54299 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revidev Revi.io revi-io-customer-and-product-reviews allows Reflected XSS.This issue affects Revi.io: from n/a through <= 5.7.3.

  Product

  Revi.io

  Affected

  up to 5.7.3

  What to do

  Affects up to 5.7.3. Update Revi.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Role Includer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54290 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Fletcher Role Includer role-includer allows Reflected XSS.This issue affects Role Includer: from n/a through <= 1.6.

  Product

  Role Includer

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Role Includer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024LDD Directory Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54288 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LDD Web Design LDD Directory Lite ldd-directory-lite allows Reflected XSS.This issue affects LDD Directory Lite: from n/a through <= 3.3.

  Product

  LDD Directory Lite

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update LDD Directory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Advanced Blog Post Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54287 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.

  Product

  Advanced Blog Post Block

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Advanced Blog Post Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Smaily for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54286 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This issue affects Smaily for WP: from n/a through <= 3.1.5.

  Product

  Smaily for WP

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Smaily for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Nias course: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54277 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based XSS.This issue affects Nias course: from n/a through <= 1.2.10.

  Product

  Nias course

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Nias course to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Poll Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54276 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devfelixmoira Poll Builder poll-builder allows Stored XSS.This issue affects Poll Builder: from n/a through <= 1.3.5.

  Product

  Poll Builder

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Poll Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024CSV to html: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54275 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wibergsweb CSV to html csv-to-html allows Reflected XSS.This issue affects CSV to html: from n/a through <= 3.08.

  Product

  CSV to html

  Affected

  up to 3.08

  What to do

  Affects up to 3.08. Update CSV to html to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54274 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.

  Product

  WordPress HelpDesk & Support Ticket System Plugin – Octrace Support

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Radius Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54272 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS.This issue affects Radius Blocks: from n/a through <= 2.1.2.

  Product

  Radius Blocks

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Radius Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024ImageRecycle pdf & image compression: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54266 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compression: from n/a through <= 3.1.16.

  Product

  ImageRecycle pdf & image compression

  Affected

  up to 3.1.16

  What to do

  Affects up to 3.1.16. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54265 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.6.

  Product

  Barcode Scanner with Inventory & Order Manager

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Shortcodes Blocks Creator Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54264 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/a through <= 2.2.0.

  Product

  Shortcodes Blocks Creator Ultimate

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Shortcodes Blocks Creator Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Prodigy Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54250 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.

  Product

  Prodigy Commerce

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54246 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.

  Product

  FAQs

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54245 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.

  Product

  Clients

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Easy Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54244 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.

  Product

  Easy Replace

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Easy Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Echoza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54243 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.

  Product

  Echoza

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Echoza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Blaze Online eParcel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54240 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.

  Product

  Blaze Online eParcel for WooCommerce

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Blaze Online eParcel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.

  Product

  Board Document Manager from CHUHPL

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Ni CRM Lead: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54237 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.

  Product

  Ni CRM Lead

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Ni WooCommerce Bulk Product Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54236 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.

  Product

  Ni WooCommerce Bulk Product Editor

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update Ni WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Shiptimize for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54235 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.86.

  Product

  Shiptimize for WooCommerce

  Affected

  up to 3.1.86

  What to do

  Affects up to 3.1.86. Update Shiptimize for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54233 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.

  Product

  Advanced Control Manager for WordPress by ItalyStrap

  Affected

  up to 2.16.0

  What to do

  Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Ni WooCommerce Order Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54231 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-order-export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through <= 3.1.6.

  Product

  Ni WooCommerce Order Export

  Affected

  up to 3.1.6

  What to do

  Affects up to 3.1.6. Update Ni WooCommerce Order Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2023-33995 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.

  Product

  Photo Gallery by 10Web

  Affected

  up to 1.8.15

  What to do

  Affects up to 1.8.15. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 13, 2024eRoom – Zoom Meetings & Webinar: Missing AuthorizationCVE-2022-43472 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.

  Product

  eRoom – Zoom Meetings & Webinar

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update eRoom – Zoom Meetings & Webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 12, 2024Web3 Crypto Payments by DePay for WooCommerce: Unauthorized access of dataCVE-2024-12265 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation.

  Product

  Web3 Crypto Payments by DePay for WooCommerce

  Affected

  up to 2.12.17

  What to do

  Affects up to 2.12.17. Update Web3 Crypto Payments by DePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 11, 2024Website Toolbox Community: Reflected Cross-Site ScriptingCVE-2024-12338 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolbox_username’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Website Toolbox Community

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Website Toolbox Community to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · WordPress plugins & themes · reported by WordfenceHigh 7.1

  The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.

  Product

  RapidLoad – Optimize Web Vitals Automatically

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Dec 9, 2024News Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54260 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.

  Product

  News Kit Elementor Addons

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54253 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.6.5.

  Product

  Xpro Elementor Addons

  Affected

  up to 1.4.6.5

  What to do

  Affects up to 1.4.6.5. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024ABCBiz Addons and Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54247 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2.

  Product

  ABCBiz Addons and Templates for Elementor

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update ABCBiz Addons and Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024RRAddons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54232 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through <= 1.1.0.

  Product

  RRAddons for Elementor

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update RRAddons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024Unlock Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54230 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for-elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through <= 2.2.4.

  Product

  Unlock Addons for Elementor

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update Unlock Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024Wot Elementor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54228 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-elementor-widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through <= 1.0.1.

  Product

  Wot Elementor Widgets

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Wot Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54224 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows DOM-Based XSS.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.7.

  Product

  ElementsReady Addons for Elementor

  Affected

  up to 6.4.7

  What to do

  Affects up to 6.4.7. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024ARForms Form Builder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-54223 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.

  Product

  ARForms Form Builder

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024FAT Services Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54220 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Services Booking fat-services-booking allows Stored XSS.This issue affects FAT Services Booking: from n/a through <= 5.6.

  Product

  FAT Services Booking

  Affected

  up to 5.6

  What to do

  Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024AIO Contact: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54219 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.

  Product

  AIO Contact

  Affected

  up to 2.8.1

  What to do

  Affects up to 2.8.1. Update AIO Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53818 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.15.

  Product

  PostX

  Affected

  up to 4.1.15

  What to do

  Affects up to 4.1.15. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.