Vulnerability database

5,856 results · page 90 of 118

• Oct 5, 2024Zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through <= 7.3.10.

  Product

  Zotpress

  Affected

  up to 7.3.10

  What to do

  Affects up to 7.3.10. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Robokassa payment gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.6.1.

  Product

  Robokassa payment gateway for Woocommerce

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Robokassa payment gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 2.5.9.

  Product

  JobSearch

  Affected

  up to 2.5.9

  What to do

  Affects up to 2.5.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Quill Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47393 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohamed Magdy Quill Forms quillforms allows Stored XSS.This issue affects Quill Forms: from n/a through <= 3.7.0.

  Product

  Quill Forms

  Affected

  up to 3.7.0

  What to do

  Affects up to 3.7.0. Update Quill Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47392 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through <= 5.7.5.

  Product

  Element Pack Elementor Addons

  Affected

  up to 5.7.5

  What to do

  Affects up to 5.7.5. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47391 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through < 5.1.1.

  Product

  Bold Page Builder

  Fixed in

  5.1.1

  What to do

  Update Bold Page Builder to 5.1.1 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Jeg Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47390 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme Jeg Elementor Kit jeg-elementor-kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through <= 2.6.8.

  Product

  Jeg Elementor Kit

  Affected

  up to 2.6.8

  What to do

  Affects up to 2.6.8. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47389 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 8.7.3.

  Product

  NEX-Forms

  Affected

  up to 8.7.3

  What to do

  Affects up to 8.7.3. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Reflected XSS.This issue affects SliceWP: from n/a through <= 1.1.18.

  Product

  SliceWP

  Affected

  up to 1.1.18

  What to do

  Affects up to 1.1.18. Update SliceWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47387 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 1.8.2.

  Product

  Search Atlas SEO

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024The Ultimate WordPress Toolkit – WP Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47386 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.8.

  Product

  The Ultimate WordPress Toolkit – WP Extended

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Essential Blocks for Gutenberg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47385 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.4.

  Product

  Essential Blocks for Gutenberg

  Affected

  up to 4.8.4

  What to do

  Affects up to 4.8.4. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024WP Compress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47384 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.This issue affects WP Compress: from n/a through <= 6.20.13.

  Product

  WP Compress

  Affected

  up to 6.20.13

  What to do

  Affects up to 6.20.13. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47383 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.0.8.8.

  Product

  The Pack Elementor addons

  Affected

  up to 2.0.8.8

  What to do

  Affects up to 2.0.8.8. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Page-list: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47382 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.6.

  Product

  Page-list

  Affected

  up to 5.6

  What to do

  Affects up to 5.6. Update Page-list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Depicter Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47381 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Depicter Slider depicter allows Stored XSS.This issue affects Depicter Slider: from n/a through <= 3.2.2.

  Product

  Depicter Slider

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024WP-Lister Lite for eBay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47380 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Reflected XSS.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.6.3.

  Product

  WP-Lister Lite for eBay

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Web Directory Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47379 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.3.

  Product

  Web Directory Free

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Web Directory Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024WPCOM Member: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47378 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lomu WPCOM Member wpcom-member allows Reflected XSS.This issue affects WPCOM Member: from n/a through <= 1.5.4.

  Product

  WPCOM Member

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47630 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.7.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47629 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.0.5.

  Product

  Ultimate Store Kit Elementor Addons

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47628 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.3.9.3.

  Product

  LA-Studio Element Kit for Elementor

  Affected

  up to 1.3.9.3

  What to do

  Affects up to 1.3.9.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024WP Travel Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47627 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.6.0.

  Product

  WP Travel Gutenberg Blocks

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update WP Travel Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024RTMKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47626 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.5.0.

  Product

  RTMKit

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Enter Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47625 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.8.

  Product

  Enter Addons

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Enter Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Helpie FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47647 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Essekia Helpie FAQ helpie-faq allows Stored XSS.This issue affects Helpie FAQ: from n/a through <= 1.27.

  Product

  Helpie FAQ

  Affected

  up to 1.27

  What to do

  Affects up to 1.27. Update Helpie FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Copyscape Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47644 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Copyscape Copyscape Premium copyscape-premium allows Stored XSS.This issue affects Copyscape Premium: from n/a through <= 1.3.9.

  Product

  Copyscape Premium

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Copyscape Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Include Fussball.de Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47643 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Include Fussball.de Widgets include-fussball-de-widgets allows Stored XSS.This issue affects Include Fussball.de Widgets: from n/a through <= 4.0.0.

  Product

  Include Fussball.de Widgets

  Affected

  up to 4.0.0

  What to do

  Affects up to 4.0.0. Update Include Fussball.de Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Keap Official Opt-in Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47642 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms infusionsoft-official-opt-in-forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through <= 2.0.3.

  Product

  Keap Official Opt-in Forms

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024VdoCipher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47639 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vibhav Sinha VdoCipher vdocipher allows Stored XSS.This issue affects VdoCipher: from n/a through <= 1.29.

  Product

  VdoCipher

  Affected

  up to 1.29

  What to do

  Affects up to 1.29. Update VdoCipher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47638 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.4.6.

  Product

  Online Booking & Scheduling Calendar for WordPress by vcita

  Affected

  up to 4.4.6

  What to do

  Affects up to 4.4.6. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Zoho Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47633 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Zoho Forms zoho-forms allows Stored XSS.This issue affects Zoho Forms: from n/a through <= 4.0.

  Product

  Zoho Forms

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Zoho Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47632 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.7.

  Product

  DethemeKit For Elementor

  Affected

  up to 2.1.7

  What to do

  Affects up to 2.1.7. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Logo Carousel – Clients logo carousel for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47631 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for WP: from n/a through <= 1.2.

  Product

  Logo Carousel – Clients logo carousel for WP

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Logo Carousel – Clients logo carousel for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 2, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Reflected Cross-Site ScriptingCVE-2024-9222 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction

  Affected

  up to 2.12.8

  What to do

  Affects up to 2.12.8. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 30, 2024Move Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47396 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through <= 1.3.3.

  Product

  Move Addons for Elementor

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2024Confetti Fall Animation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47641 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muhammad Shakeel Confetti Fall Animation confetti-fall-animation allows Stored XSS.This issue affects Confetti Fall Animation: from n/a through <= 1.3.0.

  Product

  Confetti Fall Animation

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Confetti Fall Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 25, 2024Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43959 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials super-testimonial allows Reflected XSS.This issue affects Testimonials: from n/a through <= 4.0.1.

  Product

  Testimonials

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 25, 2024Livemesh Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47303 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Cross-Site Scripting (XSS).This issue affects Livemesh Addons for Elementor: from n/a through <= 8.5.

  Product

  Livemesh Addons for Elementor

  Affected

  up to 8.5

  What to do

  Affects up to 8.5. Update Livemesh Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44005 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 9.3.7.

  Product

  Greenshift

  Affected

  up to 9.3.7

  What to do

  Affects up to 9.3.7. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Spice Starter Sites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44003 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through <= 1.2.5.

  Product

  Spice Starter Sites

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Spice Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Team Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44002 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This issue affects Team Showcase: from n/a through <= 1.22.25.

  Product

  Team Showcase

  Affected

  up to 1.22.25

  What to do

  Affects up to 1.22.25. Update Team Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44001 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects Royal Elementor Addons: from n/a through <= 1.3.982.

  Product

  Royal Elementor Addons

  Affected

  up to 1.3.982

  What to do

  Affects up to 1.3.982. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43999 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.

  Product

  Ninja Forms

  Affected

  up to 3.8.11

  What to do

  Affects up to 3.8.11. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Posterity: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43995 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.

  Product

  Posterity

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Posterity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Kahuna: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43994 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Kahuna allows Stored XSS.This issue affects Kahuna: from n/a through 1.7.0.

  Product

  Kahuna

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Kahuna to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Liquido: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43993 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Liquido allows Stored XSS.This issue affects Liquido: from n/a through 1.0.1.2.

  Product

  Liquido

  Affected

  up to 1.0.1.2

  What to do

  Affects up to 1.0.1.2. Update Liquido to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024LatePoint: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43992 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.This issue affects LatePoint: from n/a through 4.9.91.

  Product

  LatePoint

  Affected

  up to 4.9.91

  What to do

  Affects up to 4.9.91. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Hotel Galaxy: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43991 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webdzier Hotel Galaxy allows Stored XSS.This issue affects Hotel Galaxy: from n/a through 4.4.24.

  Product

  Hotel Galaxy

  Affected

  up to 4.4.24

  What to do

  Affects up to 4.4.24. Update Hotel Galaxy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 17, 2024Mystique: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43988 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digitalnature Mystique allows Stored XSS.This issue affects Mystique: from n/a through 2.5.7.

  Product

  Mystique

  Affected

  up to 2.5.7

  What to do

  Affects up to 2.5.7. Update Mystique to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.