🦸 🧭 Calling all superheroes and explorers! Introducing the WordPress Superhero Challenge and WordPress XSSplorer Challenge for the Wordfence Bug Bounty Program: Earn up to $31,200 for High Impact Vulnerabilities AND XSS vulnerabilities are in scope for all researchers in plugins/themes >= 1,000 Active Installs!

Through October 7th, 2024 all Cross-Site Scripting (XSS) vulnerabilities in plugins/themes with >= 1,000 Active Installs will be in scope for all researchers regardless of researcher tier. In addition, through October 14th, 2024, all vulnerabilities reported in plugins or themes with >= 5,000,000 active installs will be 3x our highest bounty rewards making our top reward $31,200.

Check out the updated bounties here!

Vulnerabilities protected by our XSS: Cross Site Scripting firewall rule

22,848,814

Attacks Blocked in Past 24 Hours

Showing 61-80 of 6,627 Vulnerabilities

Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2022-3399

Aug 15, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via CSS Styles

4.4

CVE-2024-6617

Aug 15, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-6493

Aug 15, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

KBucket: Your Curated Content in WordPress <= 4.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-6665

Aug 15, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Event Tickets with Ticket Scanner <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-6711

Aug 13, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Flaming Forms <= 1.0.1 - Reflected Cross-Site Scripting

6.1

CVE-2024-7692

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

MyBookTable Bookstore <= 3.3.9 - Cross-Site Request Forgery

6.1

CVE-2024-43255

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting

4.0

CVE-2024-7388

Aug 12, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Indeed Membership Pro <= 12.6 - Reflected Cross-Site Scripting

6.1

CVE-2024-43241

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Houzez <= 3.2.4 - Reflected Cross-Site Scripting

6.1

CVE-2024-43244

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Flaming Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-7691

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

WHMpress <= 6.2-revision-5 - Reflected Cross-Site Scripting

6.1

CVE-2024-43246

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

weMail <= 1.14.5 - Reflected Cross-Site Scripting

6.1

CVE-2024-43238

Aug 12, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

DL Verification <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-6798

Aug 10, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

DL Robots.txt <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-6797

Aug 10, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Wordpress Simple Share Plugin <= 0.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-7556

Aug 10, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

WP MultiTasking <= 0.1.12 - Reflected Cross-Site Scripting

6.1

CVE-2024-6859

Aug 10, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

WP Dashboard Notes <= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVE-2024-43226

Aug 9, 2024

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Filr – Secure document library <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVE-2024-43216

Aug 9, 2024

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting

6.1

CVE-2024-43220

Aug 9, 2024

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Title	CVE ID	CVSS	Vector	Date
Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2022-3399	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 15, 2024
NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via CSS Styles	CVE-2024-6617	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 15, 2024
NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-6493	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 15, 2024
KBucket: Your Curated Content in WordPress <= 4.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-6665	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 15, 2024
Event Tickets with Ticket Scanner <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-6711	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 13, 2024
Flaming Forms <= 1.0.1 - Reflected Cross-Site Scripting	CVE-2024-7692	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
MyBookTable Bookstore <= 3.3.9 - Cross-Site Request Forgery	CVE-2024-43255	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting	CVE-2024-7388	4.0	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
Indeed Membership Pro <= 12.6 - Reflected Cross-Site Scripting	CVE-2024-43241	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
Houzez <= 3.2.4 - Reflected Cross-Site Scripting	CVE-2024-43244	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
Flaming Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting	CVE-2024-7691	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	August 12, 2024
WHMpress <= 6.2-revision-5 - Reflected Cross-Site Scripting	CVE-2024-43246	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
weMail <= 1.14.5 - Reflected Cross-Site Scripting	CVE-2024-43238	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 12, 2024
DL Verification <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-6798	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 10, 2024
DL Robots.txt <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-6797	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 10, 2024
Wordpress Simple Share Plugin <= 0.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2024-7556	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 10, 2024
WP MultiTasking <= 0.1.12 - Reflected Cross-Site Scripting	CVE-2024-6859	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 10, 2024
WP Dashboard Notes <= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting	CVE-2024-43226	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 9, 2024
Filr – Secure document library <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting	CVE-2024-43216	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	August 9, 2024
Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting	CVE-2024-43220	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 9, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation