Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,859 results · page 82 of 118

Nov 11, 2024BU Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52351 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Slideshow bu-slideshow allows Stored XSS.This issue affects BU Slideshow: from n/a through <= 2.3.10.
Product
BU Slideshow
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update BU Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024CRM 2go: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52350 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue affects CRM 2go: from n/a through <= 1.0.
Product
CRM 2go
Affected
up to 1.0
What to do
Affects up to 1.0. Update CRM 2go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Responsive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52358 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows DOM-Based XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.5.4.
Product
Responsive Addons for Elementor
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024LIQUID BLOCKS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52357 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This issue affects LIQUID BLOCKS: from n/a through <= 1.2.0.
Product
LIQUID BLOCKS
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update LIQUID BLOCKS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52356 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.0.
Product
The Pack Elementor addons
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Extender All In One For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Abdullah Al Masum Extender All In One For Elementor extender-all-in-one-for-elementor allows Stored XSS.This issue affects Extender All In One For Elementor: from n/a through <= 1.0.3.
Product
Extender All In One For Elementor
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Extender All In One For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Simple Goods: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Goods Simple Goods simple-goods allows Stored XSS.This issue affects Simple Goods: from n/a through <= 0.1.3.
Product
Simple Goods
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Simple Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024ML Responsive Audio player with playlist Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ersatzpole ML Responsive Audio player with playlist Shortcode mlr-audio allows Stored XSS.This issue affects ML Responsive Audio player with playlist Shortcode: from n/a through <= 0.2.
Product
ML Responsive Audio player with playlist Shortcode
Affected
up to 0.2
What to do
Affects up to 0.2. Update ML Responsive Audio player with playlist Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024LH QR Codes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH QR Codes lh-qr-codes allows Stored XSS.This issue affects LH QR Codes: from n/a through <= 1.06.
Product
LH QR Codes
Affected
up to 1.06
What to do
Affects up to 1.06. Update LH QR Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024MasterBip para Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.
Product
MasterBip para Elementor
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update MasterBip para Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024AMP Img Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpza AMP Img Shortcode amp-img-shortcode allows Stored XSS.This issue affects AMP Img Shortcode: from n/a through <= 1.0.1.
Product
AMP Img Shortcode
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update AMP Img Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 20243D Presentation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lpagg 3D Presentation 3d-presentation allows Stored XSS.This issue affects 3D Presentation: from n/a through <= 1.0.
Product
3D Presentation
Affected
up to 1.0
What to do
Affects up to 1.0. Update 3D Presentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024bpmn.io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neville.lugton bpmn.io bpmnio allows Stored XSS.This issue affects bpmn.io: from n/a through <= 1.0.
Product
bpmn.io
Affected
up to 1.0
What to do
Affects up to 1.0. Update bpmn.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024Marquee Elementor with Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51584 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anas2004 Marquee Elementor with Posts marquee-elementor allows DOM-Based XSS.This issue affects Marquee Elementor with Posts: from n/a through <= 1.2.0.
Product
Marquee Elementor with Posts
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Marquee Elementor with Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024Kento Ads Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51583 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento Ads Rotator kento-ads-rotator allows Stored XSS.This issue affects Kento Ads Rotator: from n/a through <= 1.3.
Product
Kento Ads Rotator
Affected
up to 1.3
What to do
Affects up to 1.3. Update Kento Ads Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows Stored XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.6.
Product
Restaurant & Cafe Addon for Elementor
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024Clever Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zootemplate Clever Addons for Elementor cafe-lite allows Stored XSS.This issue affects Clever Addons for Elementor: from n/a through <= 2.2.1.
Product
Clever Addons for Elementor
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Clever Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Display Terms Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes Display Terms Shortcode display-terms-shortcode allows Stored XSS.This issue affects Display Terms Shortcode: from n/a through <= 1.0.4.
Product
Display Terms Shortcode
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Display Terms Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Emoji Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Emoji Shortcode emoji-shortcode allows Stored XSS.This issue affects Emoji Shortcode: from n/a through <= 1.0.0.
Product
Emoji Shortcode
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Emoji Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Genoo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51605 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genoo Genoo genoo allows DOM-Based XSS.This issue affects Genoo: from n/a through <= 6.0.10.
Product
Genoo
Affected
up to 6.0.10
What to do
Affects up to 6.0.10. Update Genoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Media Modal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51604 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmabugay Media Modal media-modal allows DOM-Based XSS.This issue affects Media Modal: from n/a through <= 1.0.2.
Product
Media Modal
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Media Modal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024NMR Strava activities: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51603 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through <= 1.0.7.
Product
NMR Strava activities
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update NMR Strava activities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Simple Business Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51599 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in russell.albin Simple Business Manager simple-business-manager allows Stored XSS.This issue affects Simple Business Manager: from n/a through <= 4.6.7.4.
Product
Simple Business Manager
Affected
up to 4.6.7.4
What to do
Affects up to 4.6.7.4. Update Simple Business Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Selar.co Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kendysond Selar.co Widget selar-co-widget allows DOM-Based XSS.This issue affects Selar.co Widget: from n/a through <= 1.2.
Product
Selar.co Widget
Affected
up to 1.2
What to do
Affects up to 1.2. Update Selar.co Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024ThemeShark Templates & Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeshark ThemeShark Templates & Widgets for Elementor themeshark-elementor allows Stored XSS.This issue affects ThemeShark Templates & Widgets for Elementor: from n/a through <= 1.1.7.
Product
ThemeShark Templates & Widgets for Elementor
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update ThemeShark Templates & Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Business: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51596 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nilesh Shiragave Business business allows Stored XSS.This issue affects Business: from n/a through <= 1.3.
Product
Business
Affected
up to 1.3
What to do
Affects up to 1.3. Update Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024SKSDEV Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKSDEV SKSDEV Toolkit sksdev-toolkit allows Stored XSS.This issue affects SKSDEV Toolkit: from n/a through <= 1.0.0.
Product
SKSDEV Toolkit
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update SKSDEV Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Gmap Point List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rafel.sanso Gmap Point List gmap-point-list allows Stored XSS.This issue affects Gmap Point List: from n/a through <= 1.1.2.
Product
Gmap Point List
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Gmap Point List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Курс валют UAH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glopium Курс валют UAH ukrainian-currency allows Stored XSS.This issue affects Курс валют UAH: from n/a through <= 2.0.
Product
Курс валют UAH
Affected
up to 2.0
What to do
Affects up to 2.0. Update Курс валют UAH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Meta Store Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mystical Themes Meta Store Elements meta-store-elements allows DOM-Based XSS.This issue affects Meta Store Elements: from n/a through <= 1.0.9.
Product
Meta Store Elements
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Meta Store Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Slicko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51591 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids Slicko slicko-for-elementor allows DOM-Based XSS.This issue affects Slicko: from n/a through <= 1.2.0.
Product
Slicko
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Slicko to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Hoo Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51590 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HooThemes Hoo Addons for Elementor hoo-addons-for-elementor allows DOM-Based XSS.This issue affects Hoo Addons for Elementor: from n/a through <= 1.0.6.
Product
Hoo Addons for Elementor
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Hoo Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Bigmart Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcirqle Bigmart Elements bigmart-elements allows DOM-Based XSS.This issue affects Bigmart Elements: from n/a through <= 1.0.3.
Product
Bigmart Elements
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Bigmart Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Super Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riponhossain Super Addons for Elementor super-addons-for-elementor allows DOM-Based XSS.This issue affects Super Addons for Elementor: from n/a through <= 1.0.
Product
Super Addons for Elementor
Affected
up to 1.0
What to do
Affects up to 1.0. Update Super Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Definitive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51587 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softfirm Definitive Addons for Elementor definitive-addons-for-elementor allows Stored XSS.This issue affects Definitive Addons for Elementor: from n/a through <= 1.5.16.
Product
Definitive Addons for Elementor
Affected
up to 1.5.16
What to do
Affects up to 1.5.16. Update Definitive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Elementary Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in camilluskillus Elementary Addons elementary-addons allows Stored XSS.This issue affects Elementary Addons: from n/a through <= 2.0.4.
Product
Elementary Addons
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Elementary Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Sales Page Addon – Elementor & Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Sales Page Addon – Elementor & Beaver Builder sales-page-addon allows Stored XSS.This issue affects Sales Page Addon – Elementor & Beaver Builder: from n/a through <= 1.4.5.
Product
Sales Page Addon – Elementor & Beaver Builder
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Sales Page Addon – Elementor & Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024MyCurator Content Curation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51668 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mtilly MyCurator Content Curation mycurator allows Stored XSS.This issue affects MyCurator Content Curation: from n/a through <= 3.78.
Product
MyCurator Content Curation
Affected
up to 3.78
What to do
Affects up to 3.78. Update MyCurator Content Curation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51664 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.25.
Product
Beds24 Online Booking
Affected
up to 2.0.25
What to do
Affects up to 2.0.25. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Bricksable for Bricks Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51663 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable Bricksable for Bricks Builder bricksable allows Stored XSS.This issue affects Bricksable for Bricks Builder: from n/a through <= 1.6.59.
Product
Bricksable for Bricks Builder
Affected
up to 1.6.59
What to do
Affects up to 1.6.59. Update Bricksable for Bricks Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.6.
Product
Black Widgets For Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Header Footer Composer for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51629 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MetricThemes Header Footer Composer for Elementor header-footer-composer allows DOM-Based XSS.This issue affects Header Footer Composer for Elementor: from n/a through <= 1.0.4.
Product
Header Footer Composer for Elementor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Header Footer Composer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024EzyOnlineBookings Online Booking System Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51628 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EzyOnlineBookings EzyOnlineBookings Online Booking System Widget ezyonlinebookings-online-booking-system allows DOM-Based XSS.This issue affects EzyOnlineBookings Online Booking System Widget: from n/a through <= 1.3.
Product
EzyOnlineBookings Online Booking System Widget
Affected
up to 1.3
What to do
Affects up to 1.3. Update EzyOnlineBookings Online Booking System Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Audio Comparison Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51627 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kaedinger Audio Comparison Lite audio-comparison-lite allows Stored XSS.This issue affects Audio Comparison Lite: from n/a through <= 3.4.
Product
Audio Comparison Lite
Affected
up to 3.4
What to do
Affects up to 3.4. Update Audio Comparison Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP EASY RECIPE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51622 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN WP EASY RECIPE wp-easy-recipe allows Stored XSS.This issue affects WP EASY RECIPE: from n/a through <= 1.6.
Product
WP EASY RECIPE
Affected
up to 1.6
What to do
Affects up to 1.6. Update WP EASY RECIPE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Custom Admin Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51618 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Admin Menu custom-admin-menu allows Stored XSS.This issue affects Custom Admin Menu: from n/a through <= 1.0.0.
Product
Custom Admin Menu
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024AwesomePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rupok AwesomePress awesomepress allows Stored XSS.This issue affects AwesomePress: from n/a through <= 1.0.
Product
AwesomePress
Affected
up to 1.0
What to do
Affects up to 1.0. Update AwesomePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Aajoda Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aajoda Aajoda Testimonials aajoda-testimonials allows Stored XSS.This issue affects Aajoda Testimonials: from n/a through <= 2.2.2.
Product
Aajoda Testimonials
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Aajoda Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024TradeMe widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bidbud TradeMe widgets trademe-widget allows Stored XSS.This issue affects TradeMe widgets: from n/a through <= 1.2.
Product
TradeMe widgets
Affected
up to 1.2
What to do
Affects up to 1.2. Update TradeMe widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Reftagger Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51612 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designerken Reftagger Shortcode reftagger-shortcode allows Stored XSS.This issue affects Reftagger Shortcode: from n/a through <= 1.1.
Product
Reftagger Shortcode
Affected
up to 1.1
What to do
Affects up to 1.1. Update Reftagger Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.