Have you found a vulnerability in a WordPress plugin or theme? Report vulnerabilities in WordPress plugins and themes through our bug bounty program and earn a bounty on all in-scope submissions, while we handle the responsible disclosure process on your behalf.

Vulnerabilities protected by our Stored Cross-Site Scripting via Shortcode firewall rule

1,266

Attacks Blocked in Past 24 Hours

Showing 1-20 of 619 Vulnerabilities

Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12508

Jan 16, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11870

Jan 14, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12818

Jan 14, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12519

Jan 10, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11758

Jan 10, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Accordion Slider Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11892

Jan 10, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12527

Jan 10, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Dominion – Domain Checker for WPBakery <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12520

Jan 10, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12505

Jan 10, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12819

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12493

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12496

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Muslim Prayer Time-Salah/Iqamah <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12515

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12514

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11907

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SimplyRETS Real Estate IDX <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12491

Jan 8, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-12521

Jan 7, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2024-12437

Jan 6, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11887

Jan 6, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-11756

Jan 6, 2025

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12508	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 16, 2025
Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11870	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 14, 2025
WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12818	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 14, 2025
TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12519	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 10, 2025
WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11758	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 10, 2025
Accordion Slider Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11892	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 10, 2025
Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12527	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 10, 2025
Dominion – Domain Checker for WPBakery <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12520	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 10, 2025
Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12505	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 10, 2025
Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12819	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12493	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12496	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
Muslim Prayer Time-Salah/Iqamah <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12515	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12514	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11907	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
SimplyRETS Real Estate IDX <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12491	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 8, 2025
Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-12521	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 7, 2025
Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	CVE-2024-12437	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 6, 2025
Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11887	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 6, 2025
SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	CVE-2024-11756	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	January 6, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation