Vulnerabilities protected by our XSS: Cross Site Scripting firewall rule

30,397,054
Attacks Blocked in Past 24 Hours

Showing 1-20 of 6,463 Vulnerabilities

ParityPress <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
5.5
CVE-2024-6661
Jul 26, 2024
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']
6.1
CVE-2024-5744
Jul 23, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
7.2
CVE-2024-6828
Jul 22, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
WP GoToWebinar <= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-38776
Jul 19, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Category Posts Widget <= 4.9.16 & Pro < 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-6158
Jul 19, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Livemesh Addons for Beaver Builder <= 3.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-38784
Jul 19, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CopySafe Web Protection <= 3.15 - Reflected Cross-Site Scripting
6.1
CVE-2024-38781
Jul 19, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification
7.1
CVE-2024-1937
Jul 15, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Master Addons for Elementor <= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-38710
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2024-38744
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Zoho CRM Lead Magnet <= 1.7.8.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-38696
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Admin Dashboard RSS Feed <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-38725
Jul 11, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Link Library <= 7.7.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-38711
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Goftino <= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-38697
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Ultimate Classified Listings <= 1.3 - Reflected Cross-Site Scripting
6.1
CVE-2024-6529
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-38752
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Change From Email <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-38738
Jul 11, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Moloni <= 4.7.4 - Reflected Cross-Site Scripting
6.1
CVE-2024-38694
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-38713
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting
6.1
CVE-2024-37117
Jul 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Title CVE ID CVSS Vector Date
ParityPress <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-6661 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N July 26, 2024
WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] CVE-2024-5744 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 23, 2024
Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting CVE-2024-6828 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N July 22, 2024
WP GoToWebinar <= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2024-38776 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 19, 2024
Category Posts Widget <= 4.9.16 & Pro < 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-6158 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N July 19, 2024
Livemesh Addons for Beaver Builder <= 3.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-38784 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N July 19, 2024
CopySafe Web Protection <= 3.15 - Reflected Cross-Site Scripting CVE-2024-38781 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 19, 2024
Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification CVE-2024-1937 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L July 15, 2024
Master Addons for Elementor <= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-38710 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting CVE-2024-38744 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024
Zoho CRM Lead Magnet <= 1.7.8.8 - Reflected Cross-Site Scripting CVE-2024-38696 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024
Admin Dashboard RSS Feed <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-38725 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Link Library <= 7.7.1 - Reflected Cross-Site Scripting CVE-2024-38711 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024
Goftino <= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-38697 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Ultimate Classified Listings <= 1.3 - Reflected Cross-Site Scripting CVE-2024-6529 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024
Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-38752 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Change From Email <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-38738 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Moloni <= 4.7.4 - Reflected Cross-Site Scripting CVE-2024-38694 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024
WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-38713 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N July 11, 2024
Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting CVE-2024-37117 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N July 11, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation