Vulnerability database

6,573 results · page 84 of 132

• Dec 2, 2024amr shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52464 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anmari amr shortcodes amr-shortcodes allows Reflected XSS.This issue affects amr shortcodes: from n/a through <= 1.7.

  Product

  amr shortcodes

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update amr shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Post By Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52463 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Westwood Post By Email post-by-email allows Reflected XSS.This issue affects Post By Email: from n/a through <= 1.0.4b.

  Product

  Post By Email

  Affected

  up to 1.0.4b

  What to do

  Affects up to 1.0.4b. Update Post By Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024WP e-Commerce Style Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52462 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.

  Product

  WP e-Commerce Style Email

  Affected

  up to 0.6.2

  What to do

  Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Infinite Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52461 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kinsta Infinite Slider infinite-slider allows Reflected XSS.This issue affects Infinite Slider: from n/a through <= 2.0.1.

  Product

  Infinite Slider

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Infinite Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024AtaraPay WooCommerce Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52460 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atarapay AtaraPay WooCommerce Payment Gateway atarapay-woocommerce allows Reflected XSS.This issue affects AtaraPay WooCommerce Payment Gateway: from n/a through <= 2.0.13.

  Product

  AtaraPay WooCommerce Payment Gateway

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update AtaraPay WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Chameleoni Jobs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52459 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chameleoni Chameleoni Jobs chameleon-jobs allows Reflected XSS.This issue affects Chameleoni Jobs: from n/a through <= 2.5.4.

  Product

  Chameleoni Jobs

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update Chameleoni Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.complugins.svn.wordpress.org

• Dec 2, 2024TM Islamic Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52458 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaymund TM Islamic Helper tm-islamic-helper allows Reflected XSS.This issue affects TM Islamic Helper: from n/a through <= 1.0.1.

  Product

  TM Islamic Helper

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update TM Islamic Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Youneeq Recommendations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52457 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in youneeq Youneeq Recommendations youneeq-panel allows Reflected XSS.This issue affects Youneeq Recommendations: from n/a through <= 3.0.7.

  Product

  Youneeq Recommendations

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update Youneeq Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Awesome Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52456 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoets Awesome Studio awesome-studio allows Reflected XSS.This issue affects Awesome Studio: from n/a through <= 2.4.4.

  Product

  Awesome Studio

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update Awesome Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024GoQSmile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQSmile goqsmile allows Reflected XSS.This issue affects GoQSmile: from n/a through <= 1.0.1.

  Product

  GoQSmile

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update GoQSmile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024GoQMieruca: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52454 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQMieruca goqmieruca allows Reflected XSS.This issue affects GoQMieruca: from n/a through <= 1.0.3.

  Product

  GoQMieruca

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update GoQMieruca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Library Bookshelves: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52453 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Reflected XSS.This issue affects Library Bookshelves: from n/a through <= 5.8.

  Product

  Library Bookshelves

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024Open edX LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52452 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eduNEXT Open edX LMS allows Reflected XSS.This issue affects Open edX LMS: from n/a through 2.6.1.

  Product

  Open edX LMS

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update Open edX LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 2, 2024What Would Seth Godin Do: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51900 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in James Hunt What Would Seth Godin Do what-would-seth-godin-do allows Stored XSS.This issue affects What Would Seth Godin Do: from n/a through <= 2.1.1.

  Product

  What Would Seth Godin Do

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update What Would Seth Godin Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Stripe Donation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53752 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berg Informatik Stripe Donation bin-stripe-donation allows Stored XSS.This issue affects Stripe Donation: from n/a through <= 1.2.5.

  Product

  Stripe Donation

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Stripe Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Post Carousel Slider for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53749 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Stored XSS.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.5.0.

  Product

  Post Carousel Slider for Elementor

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Post Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024WP Mermaid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53748 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP Mermaid wp-mermaid allows Stored XSS.This issue affects WP Mermaid: from n/a through <= 1.0.2.

  Product

  WP Mermaid

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Mermaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Video Player for WPBakery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53747 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nutttaro Video Player for WPBakery video-player-for-wpbakery allows Stored XSS.This issue affects Video Player for WPBakery: from n/a through <= 1.0.1.

  Product

  Video Player for WPBakery

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Video Player for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Elementor Button Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53746 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs Elementor Button Plus fd-elementor-button-plus allows Stored XSS.This issue affects Elementor Button Plus: from n/a through <= 1.3.9.

  Product

  Elementor Button Plus

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Elementor Button Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024소셜 공유 버튼 By 코스모스팜: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53745 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 코스모스팜 – Cosmosfarm 소셜 공유 버튼 By 코스모스팜 cosmosfarm-share-buttons allows Stored XSS.This issue affects 소셜 공유 버튼 By 코스모스팜: from n/a through <= 1.9.

  Product

  소셜 공유 버튼 By 코스모스팜

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update 소셜 공유 버튼 By 코스모스팜 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Elementor Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53744 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SkyBootstrap Elementor Image Gallery Plugin skyboot-portfolio-gallery allows Stored XSS.This issue affects Elementor Image Gallery Plugin: from n/a through <= 1.0.5.

  Product

  Elementor Image Gallery

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Elementor Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Countdown Timer for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53743 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh Countdown Timer for Elementor countdown-timer-for-elementor allows Stored XSS.This issue affects Countdown Timer for Elementor: from n/a through <= 1.3.6.

  Product

  Countdown Timer for Elementor

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Countdown Timer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 1, 2024Multilevel Referral Affiliate Plugin for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53742 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prism I.T. Systems Multilevel Referral Affiliate Plugin for WooCommerce multilevel-referral-plugin-for-woocommerce allows Reflected XSS.This issue affects Multilevel Referral Affiliate Plugin for WooCommerce: from n/a through <= 2.27.

  Product

  Multilevel Referral Affiliate Plugin for WooCommerce

  Affected

  up to 2.27

  What to do

  Affects up to 2.27. Update Multilevel Referral Affiliate Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Cowidgets – Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53786 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeless Cowidgets – Elementor Addons cowidgets-elementor-addons allows Stored XSS.This issue affects Cowidgets – Elementor Addons: from n/a through <= 1.2.0.

  Product

  Cowidgets – Elementor Addons

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Sparkle Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53774 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows DOM-Based XSS.This issue affects Sparkle Elementor Kit: from n/a through <= 2.0.9.

  Product

  Sparkle Elementor Kit

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Sparkle Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Znajdź Pracę z Praca.pl: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53773 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pracapl Znajdź Pracę z Praca.pl znajdz-prace-z-pracapl allows DOM-Based XSS.This issue affects Znajdź Pracę z Praca.pl: from n/a through <= 2.2.3.

  Product

  Znajdź Pracę z Praca.pl

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update Znajdź Pracę z Praca.pl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Mail Picker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53772 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through <= 1.0.15.

  Product

  Mail Picker

  Affected

  up to 1.0.15

  What to do

  Affects up to 1.0.15. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024SimpleSchema: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53771 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sergiomico SimpleSchema simpleschema-free allows DOM-Based XSS.This issue affects SimpleSchema: from n/a through <= 1.7.6.9.

  Product

  SimpleSchema

  Affected

  up to 1.7.6.9

  What to do

  Affects up to 1.7.6.9. Update SimpleSchema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Pixobe Cartography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53767 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows DOM-Based XSS.This issue affects Pixobe Cartography: from n/a through <= 1.0.1.

  Product

  Pixobe Cartography

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Pixobe Cartography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Devnex Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53766 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows DOM-Based XSS.This issue affects Devnex Addons For Elementor: from n/a through <= 1.0.9.

  Product

  Devnex Addons For Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Devnex Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Softtemplates For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53764 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Softtemplates For Elementor softtemplates-for-elementor allows DOM-Based XSS.This issue affects Softtemplates For Elementor: from n/a through <= 1.0.8.

  Product

  Softtemplates For Elementor

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Softtemplates For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Best Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53763 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rejuan Ahamed Best Addons for Elementor allows Stored XSS.This issue affects Best Addons for Elementor: from n/a through 1.0.5.

  Product

  Best Addons for Elementor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Best Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Capitalize My Title: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53760 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Capitalize My Title Capitalize My Title capitalize-my-title allows Stored XSS.This issue affects Capitalize My Title: from n/a through <= 0.5.3.

  Product

  Capitalize My Title

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update Capitalize My Title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024WP MathJax: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53758 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP MathJax wp-mathjax-plus allows Stored XSS.This issue affects WP MathJax: from n/a through <= 1.0.1.

  Product

  WP MathJax

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WP MathJax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024WP Find Your Nearest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53757 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Stored XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

  Product

  WP Find Your Nearest

  Affected

  up to 0.3.1

  What to do

  Affects up to 0.3.1. Update WP Find Your Nearest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Vertical Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53756 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aftab Husain Vertical Carousel vertical-carousel-slider allows Stored XSS.This issue affects Vertical Carousel: from n/a through <= 1.0.2.

  Product

  Vertical Carousel

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Vertical Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024WordPress Portfolio Builder – Portfolio Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53788 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through <= 1.1.7.

  Product

  WordPress Portfolio Builder – Portfolio Gallery

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 30, 2024Random Banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53787 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows Stored XSS.This issue affects Random Banner: from n/a through <= 4.2.12.

  Product

  Random Banner

  Affected

  up to 4.2.12

  What to do

  Affects up to 4.2.12. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 29, 2024Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10704 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  Photo Gallery by 10Web

  Fixed in

  1.8.31

  What to do

  Update Photo Gallery by 10Web to 1.8.31 or newer.

  Full record and what to do →NVD recordwpscan.com

• Nov 28, 2024Fintelligence Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53731 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fintelligence Fintelligence Calculator fintelligence-calculator allows Stored XSS.This issue affects Fintelligence Calculator: from n/a through <= 1.0.3.

  Product

  Fintelligence Calculator

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Fintelligence Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 28, 2024WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53737 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through <= 1.8.16.0.

  Product

  WP Mailster

  Affected

  up to 1.8.16.0

  What to do

  Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 28, 2024Fence URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53733 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harshtohit111 Fence URL fence-url allows Stored XSS.This issue affects Fence URL: from n/a through <= 2.0.0.

  Product

  Fence URL

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Fence URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 28, 2024Block Editor Bootstrap Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-11402 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kubiq Block Editor Bootstrap Blocks block-editor-bootstrap-blocks allows Reflected XSS.This issue affects Block Editor Bootstrap Blocks: from n/a through <= 6.6.1.

  Product

  Block Editor Bootstrap Blocks

  Affected

  up to 6.6.1

  What to do

  Affects up to 6.6.1. Update Block Editor Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 28, 2024LegalWeb Cloud: Stored Cross-Site ScriptingCVE-2024-11761 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The LegalWeb Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'legalweb-popup' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  LegalWeb Cloud

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update LegalWeb Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 26, 2024Elementor Website Builder – More than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-8236 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Elementor Website Builder – More than Just a Page Builder

  Affected

  up to 3.25.7

  What to do

  Affects up to 3.25.7. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 21, 2024Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes: Reflected Cross-Site ScriptingCVE-2024-11365 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 20, 2024HTML5 Lyrics Karaoke Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52473 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Lyrics Karaoke Player html5-lyrics-karaoke-player allows Reflected XSS.This issue affects HTML5 Lyrics Karaoke Player: from n/a through <= 2.4.

  Product

  HTML5 Lyrics Karaoke Player

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update HTML5 Lyrics Karaoke Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 20, 2024Weather Atlas Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52472 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weather Atlas Weather Atlas Widget weather-atlas allows Reflected XSS.This issue affects Weather Atlas Widget: from n/a through <= 3.0.3.

  Product

  Weather Atlas Widget

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update Weather Atlas Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 20, 2024Extensions for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-52471 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Reflected XSS.This issue affects Extensions for Elementor: from n/a through 2.0.37.

  Product

  Extensions for Elementor

  Affected

  up to 2.0.37

  What to do

  Affects up to 2.0.37. Update Extensions for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 20, 2024Dynamic URL SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52470 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.

  Product

  Dynamic URL SEO

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Dynamic URL SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.