Updated 19 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

5,819 results · page 99 of 117

Apr 29, 2024Recencio Book Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33648 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemory Grubb Recencio Book Reviews recencio-book-reviews allows DOM-Based XSS.This issue affects Recencio Book Reviews: from n/a through <= 1.66.0.
Product
Recencio Book Reviews
Affected
up to 1.66.0
What to do
Affects up to 1.66.0. Update Recencio Book Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Easy Set Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eftakhairul Islam & Sirajus Salayhin Easy Set Favicon allows Reflected XSS.This issue affects Easy Set Favicon: from n/a through 1.1.
Product
Easy Set Favicon
Affected
up to 1.1
What to do
Affects up to 1.1. Update Easy Set Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Advanced Most Recent Posts Mod: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33643 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Advanced Most Recent Posts Mod allows Stored XSS.This issue affects Advanced Most Recent Posts Mod: from n/a through 1.6.5.2.
Product
Advanced Most Recent Posts Mod
Affected
up to 1.6.5.2
What to do
Affects up to 1.6.5.2. Update Advanced Most Recent Posts Mod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Pretty Google Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2.
Product
Pretty Google Calendar
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Pretty Google Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Piotnet Addons For Elementor Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Reflected XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
Product
Piotnet Addons For Elementor Pro
Affected
up to 7.1.17
What to do
Affects up to 7.1.17. Update Piotnet Addons For Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Filterable Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4234 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayful Islam Filterable Portfolio allows Stored XSS.This issue affects Filterable Portfolio: from n/a through 1.6.4.
Product
Filterable Portfolio
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024CF7 File Download – File Download for CF7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33697 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allows Stored XSS.This issue affects CF7 File Download – File Download for CF7: from n/a through 2.0.
Product
CF7 File Download – File Download for CF7
Affected
up to 2.0
What to do
Affects up to 2.0. Update CF7 File Download – File Download for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024WordPress Ad Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33696 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet XPRESS WordPress Ad Widget allows Stored XSS.This issue affects WordPress Ad Widget: from n/a through 2.20.0.
Product
WordPress Ad Widget
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update WordPress Ad Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Fan Page Widget by ThemeNcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode Fan Page Widget by ThemeNcode allows Stored XSS.This issue affects Fan Page Widget by ThemeNcode: from n/a through 2.0.
Product
Fan Page Widget by ThemeNcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Fan Page Widget by ThemeNcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Meks ThemeForest Smart Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33694 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks ThemeForest Smart Widget allows Stored XSS.This issue affects Meks ThemeForest Smart Widget: from n/a through 1.5.
Product
Meks ThemeForest Smart Widget
Affected
up to 1.5
What to do
Affects up to 1.5. Update Meks ThemeForest Smart Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Meks Smart Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33693 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Smart Social Widget allows Stored XSS.This issue affects Meks Smart Social Widget: from n/a through 1.6.4.
Product
Meks Smart Social Widget
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Meks Smart Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Smart Recent Posts Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33692 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Satrya Smart Recent Posts Widget allows Stored XSS.This issue affects Smart Recent Posts Widget: from n/a through 1.0.3.
Product
Smart Recent Posts Widget
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Smart Recent Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Advanced Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33642 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Post List allows Stored XSS.This issue affects Advanced Post List: from n/a through 0.5.6.1.
Product
Advanced Post List
Affected
up to 0.5.6.1
What to do
Affects up to 0.5.6.1. Update Advanced Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024PopupAlly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33639 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.
Product
PopupAlly
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update PopupAlly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Annual Archive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33598 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.
Product
Annual Archive
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Annual Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024UDesign: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign allows Reflected XSS.This issue affects UDesign: from n/a through 4.7.3.
Product
UDesign
Affected
up to 4.7.3
What to do
Affects up to 4.7.3. Update UDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Blocksy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.33.
Product
Blocksy
Affected
up to 2.0.33
What to do
Affects up to 2.0.33. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024LoginPress Pro: Missing AuthorizationCVE-2024-32677 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WoodMart: Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-25790 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.
Product
WoodMart
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024RegistrationMagic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-23989 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
Product
RegistrationMagic
Affected
up to 5.1.9.2
What to do
Affects up to 5.1.9.2. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32711 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.6.3.
Product
myCred
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Image Slider Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.125.
Product
Image Slider Widget
Affected
up to 1.1.125
What to do
Affects up to 1.1.125. Update Image Slider Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024ARForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.
Product
ARForms
Affected
up to 6.4
What to do
Affects up to 6.4. Update ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Advanced Floating Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32723 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Tides Advanced Floating Content allows Stored XSS.This issue affects Advanced Floating Content: from n/a through 1.2.5.
Product
Advanced Floating Content
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Advanced Floating Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Coupon & Discount Code Reveal Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32722 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coupon & Discount Code Reveal Button allows Stored XSS.This issue affects Coupon & Discount Code Reveal Button: from n/a through 1.2.5.
Product
Coupon & Discount Code Reveal Button
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Coupon & Discount Code Reveal Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Jeg Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through 2.6.3.
Product
Jeg Elementor Kit
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024RTMKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32956 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.4.1.
Product
RTMKit
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Max Addons Pro for Bricks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32952 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BloomPixel Max Addons Pro for Bricks allows Reflected XSS.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1.
Product
Max Addons Pro for Bricks
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Max Addons Pro for Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WP Media Category Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32950 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP Media Category Management allows Reflected XSS.This issue affects WP Media Category Management: from n/a through 2.2.
Product
WP Media Category Management
Affected
up to 2.2
What to do
Affects up to 2.2. Update WP Media Category Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WooCommerce Shipping Label: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32834 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8.
Product
WooCommerce Shipping Label
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update WooCommerce Shipping Label to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024List Custom Taxonomy Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32833 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Halsey List Custom Taxonomy Widget allows Stored XSS.This issue affects List Custom Taxonomy Widget: from n/a through 4.1.
Product
List Custom Taxonomy Widget
Affected
up to 4.1
What to do
Affects up to 4.1. Update List Custom Taxonomy Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024All-in-one Like Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32815 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters All-in-one Like Widget all-in-one-facebook-like-widget.This issue affects All-in-one Like Widget: from n/a through <= 2.2.7.
Product
All-in-one Like Widget
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update All-in-one Like Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Widget Post Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32801 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This issue affects Widget Post Slider: from n/a through 1.3.5.
Product
Widget Post Slider
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Widget Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.25.
Product
Premium Addons for Elementor
Affected
up to 4.10.25
What to do
Affects up to 4.10.25. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32698 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.4.
Product
Happy Addons for Elementor
Affected
up to 3.10.4
What to do
Affects up to 3.10.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso: from n/a through 1.1.5.
Product
HelloAsso
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Infographic Maker – iList: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32696 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Infographic Maker – iList allows Stored XSS.This issue affects Infographic Maker – iList: from n/a through 4.6.6.
Product
Infographic Maker – iList
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update Infographic Maker – iList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Language Switcher for Transposh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflected XSS.This issue affects Language Switcher for Transposh: from n/a through 1.5.9.
Product
Language Switcher for Transposh
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Language Switcher for Transposh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Reflected XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.62.
Product
3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
Affected
up to 3.62
What to do
Affects up to 3.62. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024RSS Feed Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32690 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7.
Product
RSS Feed Widget
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update RSS Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 19, 2024Genesis Blocks: Does not properly escape data input provided to some of its blocksCVE-2024-2761 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
Product
Genesis Blocks
Fixed in
3.1.3
What to do
Update Genesis Blocks to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2024Superfly Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in looks_awesome Superfly Menu superfly-menu.This issue affects Superfly Menu: from n/a through <= 5.0.25.
Product
Superfly Menu
Affected
up to 5.0.25
What to do
Affects up to 5.0.25. Update Superfly Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Taggbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagbox Taggbox allows Stored XSS.This issue affects Taggbox: from n/a through 3.2.
Product
Taggbox
Affected
up to 3.2
What to do
Affects up to 3.2. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Navigation menu as Dropdown Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32126 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Navigation menu as Dropdown Widget navigation-menu-as-dropdown-widget.This issue affects Navigation menu as Dropdown Widget: from n/a through <= 1.3.4.
Product
Navigation menu as Dropdown Widget
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Navigation menu as Dropdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WP-FormAssembly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49768 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Stored XSS.This issue affects WP-FormAssembly: from n/a through 2.0.10.
Product
WP-FormAssembly
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update WP-FormAssembly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Gutenberg Block Editor Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munir Kamal Gutenberg Block Editor Toolkit allows Stored XSS.This issue affects Gutenberg Block Editor Toolkit: from n/a through 1.40.4.
Product
Gutenberg Block Editor Toolkit
Affected
up to 1.40.4
What to do
Affects up to 1.40.4. Update Gutenberg Block Editor Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Import Content in WordPress & WooCommerce with Excel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32585 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendWP Import Content in WordPress & WooCommerce with Excel allows Reflected XSS.This issue affects Import Content in WordPress & WooCommerce with Excel: from n/a through 4.2.
Product
Import Content in WordPress & WooCommerce with Excel
Affected
up to 4.2
What to do
Affects up to 4.2. Update Import Content in WordPress & WooCommerce with Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024TeraWallet – For WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StandaloneTech TeraWallet – For WooCommerce allows Stored XSS.This issue affects TeraWallet – For WooCommerce: from n/a through 1.5.0.
Product
TeraWallet – For WooCommerce
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update TeraWallet – For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflected XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.21.
Product
Photo Gallery by 10Web
Affected
up to 1.8.21
What to do
Affects up to 1.8.21. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.