Vulnerability database

6,573 results · page 83 of 132

• Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53791 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows DOM-Based XSS.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.

  Product

  Lenxel Core for Lenxel(LNX) LMS

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024Webflow Pages: Missing AuthorizationCVE-2023-49818 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Webflow Webflow Pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webflow Pages: from n/a through 1.0.8.

  Product

  Webflow Pages

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Webflow Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024LadiApp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49158 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binh Nguyen LadiApp ladipage allows Stored XSS.This issue affects LadiApp: from n/a through <= 4.4.

  Product

  LadiApp

  Affected

  up to 4.4

  What to do

  Affects up to 4.4. Update LadiApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024Super Progressive Web Apps: Missing AuthorizationCVE-2023-48277 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.

  Product

  Super Progressive Web Apps

  Affected

  up to 2.2.21

  What to do

  Affects up to 2.2.21. Update Super Progressive Web Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024wpForo Forum: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-47869 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5.

  Product

  wpForo Forum

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2024Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-30748 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7.

  Product

  Easy Appointments

  Affected

  up to 3.10.7

  What to do

  Affects up to 3.10.7. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 7, 2024FileOrganizer – Manage WordPress and Website Files: Local JavaScript File InclusionCVE-2024-11010 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

  Product

  FileOrganizer – Manage WordPress and Website Files

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 6, 2024ZionBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54213 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zionbuilder ZionBuilder zionbuilder allows Stored XSS.This issue affects ZionBuilder: from n/a through <= 3.6.16.

  Product

  ZionBuilder

  Affected

  up to 3.6.16

  What to do

  Affects up to 3.6.16. Update ZionBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54212 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.3.6.

  Product

  Magical Addons For Elementor

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Borderless: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54211 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows Cross-Site Scripting (XSS).This issue affects Borderless: from n/a through <= 1.5.8.

  Product

  Borderless

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Borderless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Advanced Element Bucket Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54210 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codexshaper Advanced Element Bucket Addons for Elementor cs-element-bucket allows Stored XSS.This issue affects Advanced Element Bucket Addons for Elementor: from n/a through <= 1.0.2.

  Product

  Advanced Element Bucket Addons for Elementor

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Advanced Element Bucket Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Awesome Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54209 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Awesome Shortcodes awesome-shortcodes allows Reflected XSS.This issue affects Awesome Shortcodes: from n/a through <= 1.7.2.

  Product

  Awesome Shortcodes

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update Awesome Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Block Controller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54208 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joni Halabi Block Controller block-controller allows Reflected XSS.This issue affects Block Controller: from n/a through <= 1.4.3.

  Product

  Block Controller

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Block Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WordPress Auction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54207 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows Stored XSS.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.

  Product

  WordPress Auction

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Z-Downloads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54206 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in URBAN BASE Z-Downloads z-downloads allows Stored XSS.This issue affects Z-Downloads: from n/a through <= 1.11.7.

  Product

  Z-Downloads

  Affected

  up to 1.11.7

  What to do

  Affects up to 1.11.7. Update Z-Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53823 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.14.

  Product

  The Plus Addons for Elementor Page Builder Lite

  Affected

  up to 5.6.14

  What to do

  Affects up to 5.6.14. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Pie Register Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53821 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Pie Register Premium allows Reflected XSS.This issue affects Pie Register Premium: from n/a before 3.8.3.3.

  Product

  Pie Register Premium

  Fixed in

  3.8.3.3

  What to do

  Update Pie Register Premium to 3.8.3.3 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Captivate Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53820 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Stored XSS.This issue affects Captivate Sync: from n/a through <= 2.0.22.

  Product

  Captivate Sync

  Affected

  up to 2.0.22

  What to do

  Affects up to 2.0.22. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WP GeoNames: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53812 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange WP GeoNames wp-geonames allows Reflected XSS.This issue affects WP GeoNames: from n/a through <= 1.8.

  Product

  WP GeoNames

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update WP GeoNames to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53802 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through <= 2.0.14.

  Product

  Futurio Extra

  Affected

  up to 2.0.14

  What to do

  Affects up to 2.0.14. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53801 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.2.1.

  Product

  Bold Page Builder

  Affected

  up to 5.2.1

  What to do

  Affects up to 5.2.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53797 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.4.3.

  Product

  Beaver Builder

  Affected

  up to 2.8.4.3

  What to do

  Affects up to 2.8.4.3. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53796 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows DOM-Based XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.2.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024Arkhe Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53794 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows Stored XSS.This issue affects Arkhe Blocks: from n/a through <= 2.27.0.

  Product

  Arkhe Blocks

  Affected

  up to 2.27.0

  What to do

  Affects up to 2.27.0. Update Arkhe Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 6, 2024WP Media Optimizer (.webp): Reflected Cross-Site ScriptingCVE-2024-12060 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WP Media Optimizer (.webp) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpmowebp-css-resources’ and 'wpmowebp-js-resources' parameters in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  WP Media Optimizer (.webp)

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update WP Media Optimizer (.webp) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Dec 3, 2024AWeber Forms by Optin Cat: Reflected Cross-Site ScriptingCVE-2024-11325 · WordPress plugins & themes · reported by WordfenceMedium 5.2

  The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  AWeber Forms by Optin Cat

  Affected

  up to 2.5.7

  What to do

  Affects up to 2.5.7. Update AWeber Forms by Optin Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 2, 2024Yahoo! WebPlayer: Cross-Site Request Forgery (CSRF)CVE-2024-53779 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Stored XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.

  Product

  Yahoo! WebPlayer

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update Yahoo! WebPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024ArCa Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through <= 1.3.1.

  Product

  ArCa Payment Gateway

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update ArCa Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Simple Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53741 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup simple-popup-plugin allows DOM-Based XSS.This issue affects Simple Popup: from n/a through <= 4.6.

  Product

  Simple Popup

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update Simple Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WooCommerce Ultimate Gift Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53740 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Reflected XSS.This issue affects WooCommerce Ultimate Gift Card: from n/a through < 2.9.1.

  Product

  WooCommerce Ultimate Gift Card

  What to do

  Update WooCommerce Ultimate Gift Card to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Advanced Event Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53721 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stachethemes Advanced Event Manager advanced-event-manager allows Stored XSS.This issue affects Advanced Event Manager: from n/a through <= 1.1.6.

  Product

  Advanced Event Manager

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Advanced Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Generic Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53709 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows DOM-Based XSS.This issue affects Generic Elements: from n/a through <= 1.2.5.

  Product

  Generic Elements

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Generic Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Tailored Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52503 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tailored Media Tailored Tools tailored-tools allows Stored XSS.This issue affects Tailored Tools: from n/a through <= 1.8.4.

  Product

  Tailored Tools

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024ImbaChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52502 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImbaSynergy ImbaChat imbachat-widget allows DOM-Based XSS.This issue affects ImbaChat: from n/a through <= 3.1.4.

  Product

  ImbaChat

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update ImbaChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Dynamic "To Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52494 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Varone, Tim Berneman Dynamic "To Top" allows Stored XSS.This issue affects Dynamic "To Top": from 3.5.2 through n/a.

  Product

  Dynamic "To Top

  What to do

  Update Dynamic "To Top to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Meteor Slides: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52493 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides meteor-slides allows Stored XSS.This issue affects Meteor Slides: from n/a through <= 1.5.7.

  Product

  Meteor Slides

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update Meteor Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Image horizontal reel scroll slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52492 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Image horizontal reel scroll slideshow image-horizontal-reel-scroll-slideshow allows Stored XSS.This issue affects Image horizontal reel scroll slideshow: from n/a through <= 13.4.

  Product

  Image horizontal reel scroll slideshow

  Affected

  up to 13.4

  What to do

  Affects up to 13.4. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Sticky Social Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52491 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanil Shakya Sticky Social Icons sticky-social-icons allows Stored XSS.This issue affects Sticky Social Icons: from n/a through <= 1.2.1.

  Product

  Sticky Social Icons

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Add Chat App Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52489 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through <= 2.1.5.

  Product

  Add Chat App Button

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Add Chat App Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Ultimate Classified Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52487 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows Stored XSS.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.

  Product

  Ultimate Classified Listings

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Elementor Portfolio Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52486 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SolverWp Elementor Portfolio Builder portfolio-builder-elementor allows DOM-Based XSS.This issue affects Elementor Portfolio Builder: from n/a through <= 1.0.0.

  Product

  Elementor Portfolio Builder

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Elementor Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Wc Recently viewed products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deepintowp Wc Recently viewed products wc-recently-viewed-products allows Reflected XSS.This issue affects Wc Recently viewed products: from n/a through <= 1.0.1.

  Product

  Wc Recently viewed products

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Wc Recently viewed products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LeanPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52483 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Benic LeanPress leanpress allows Reflected XSS.This issue affects LeanPress: from n/a through <= 1.0.0.

  Product

  LeanPress

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update LeanPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Ortto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through <= 1.0.19.

  Product

  Ortto

  Affected

  up to 1.0.19

  What to do

  Affects up to 1.0.19. Update Ortto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Jobify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52478 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Stored XSS.This issue affects Jobify: from n/a through < 4.3.0.

  Product

  Jobify

  Fixed in

  4.2.4

  What to do

  Update Jobify to 4.2.4 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WooCommerce Price Alert: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52469 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhrubok Infotech Services Ltd. WooCommerce Price Alert price-alert-woocommerce allows Reflected XSS.This issue affects WooCommerce Price Alert: from n/a through <= 1.0.4.

  Product

  WooCommerce Price Alert

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update WooCommerce Price Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LeadBoxer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadBoxer LeadBoxer leadboxer allows Reflected XSS.This issue affects LeadBoxer: from n/a through <= 1.3.

  Product

  LeadBoxer

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update LeadBoxer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024AI Responsive Gallery Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Reflected XSS.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.

  Product

  AI Responsive Gallery Album

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Explara Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52466 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Events explara-events allows Reflected XSS.This issue affects Explara Events: from n/a through <= 0.1.3.

  Product

  Explara Events

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Explara Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024LGPD Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52465 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. LGPD Framework lgpd-framework allows Reflected XSS.This issue affects LGPD Framework: from n/a through <= 2.0.2.

  Product

  LGPD Framework

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update LGPD Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.