Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

511new WordPress flaws this week

392,772entries in the database

11,311 results · page 119 of 227

Mar 15, 2025Debug-Bar-Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.
Product
Debug-Bar-Extender
Affected
up to 0.5
What to do
Affects up to 0.5. Update Debug-Bar-Extender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025WP Discord Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.
Product
WP Discord Post
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Discord Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Pre Order Addon for WooCommerce – Advance Order/Backorder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin wc-pre-order allows Reflected XSS.This issue affects Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin: from n/a through <= 2.2.
Product
Pre Order Addon for WooCommerce – Advance Order/Backorder
Affected
up to 2.2
What to do
Affects up to 2.2. Update Pre Order Addon for WooCommerce – Advance Order/Backorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Random Image Selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allows Reflected XSS.This issue affects Random Image Selector: from n/a through <= 2.4.
Product
Random Image Selector
Affected
up to 2.4
What to do
Affects up to 2.4. Update Random Image Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Random Posts, Mp3 Player + ShareButton: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23744 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through <= 1.4.1.
Product
Random Posts, Mp3 Player + ShareButton
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Random Posts, Mp3 Player + ShareButton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 14, 2025Search & Filter Pro: Unauthorized access of dataCVE-2025-1528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the values of arbitrary post meta.
Product
Search & Filter Pro
Affected
up to 2.5.19
What to do
Affects up to 2.5.19. Update Search & Filter Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record searchandfilter.com wordfence.com
Mar 13, 2025WordPress Report Brute Force Attacks and Login Protection ReportAttacks: SQL InjectionCVE-2025-2250 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Report Brute Force Attacks and Login Protection ReportAttacks
Affected
up to 2.32
What to do
Affects up to 2.32. Update WordPress Report Brute Force Attacks and Login Protection ReportAttacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025DP ALTerminator - Missing ALT manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28943 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager: from n/a through <= 1.0.2.
Product
DP ALTerminator - Missing ALT manager
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update DP ALTerminator - Missing ALT manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Lava Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28937 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through <= 1.1.9.
Product
Lava Ajax Search
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Lava Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Lunar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28936 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sakurapixel Lunar lunar-sell-photos-online allows Stored XSS.This issue affects Lunar: from n/a through <= 1.3.0.
Product
Lunar
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Lunar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025List Mixcloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28930 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodolphe MOULIN List Mixcloud list-mixcloud allows Stored XSS.This issue affects List Mixcloud: from n/a through <= 1.4.
Product
List Mixcloud
Affected
up to 1.4
What to do
Affects up to 1.4. Update List Mixcloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Tabbed Login Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows Stored XSS.This issue affects Tabbed Login Widget: from n/a through <= 1.1.2.
Product
Tabbed Login Widget
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Tabbed Login Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Post Read Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28926 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in popeating Post Read Time post-read-time allows Stored XSS.This issue affects Post Read Time: from n/a through <= 1.2.6.
Product
Post Read Time
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Post Read Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Easy Image Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28919 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shellbot Easy Image Display easy-image-display allows Stored XSS.This issue affects Easy Image Display: from n/a through <= 1.2.5.
Product
Easy Image Display
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Easy Image Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Featured Image Thumbnail Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28918 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones Featured Image Thumbnail Grid thumbnail-grid allows Stored XSS.This issue affects Featured Image Thumbnail Grid: from n/a through <= 6.8.
Product
Featured Image Thumbnail Grid
Affected
up to 6.8
What to do
Affects up to 6.8. Update Featured Image Thumbnail Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025wordpress login form to anywhere: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28914 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Sharma wordpress login form to anywhere wp-show-login-form allows Stored XSS.This issue affects wordpress login form to anywhere: from n/a through <= 0.2.
Product
wordpress login form to anywhere
Affected
up to 0.2
What to do
Affects up to 0.2. Update wordpress login form to anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025pipDisqus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28908 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pipdig pipDisqus pipdisqus allows Stored XSS.This issue affects pipDisqus: from n/a through <= 1.6.
Product
pipDisqus
Affected
up to 1.6
What to do
Affects up to 1.6. Update pipDisqus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP Last Modified: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28907 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahul Arora WP Last Modified wp-last-modified allows Stored XSS.This issue affects WP Last Modified: from n/a through <= 0.1.
Product
WP Last Modified
Affected
up to 0.1
What to do
Affects up to 0.1. Update WP Last Modified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Skitter Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28906 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow wp-skitter-slideshow allows Stored XSS.This issue affects Skitter Slideshow: from n/a through <= 2.5.2.
Product
Skitter Slideshow
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Skitter Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Featured Posts Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28905 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaser324 Featured Posts Grid featured-posts-grid allows Stored XSS.This issue affects Featured Posts Grid: from n/a through <= 1.7.
Product
Featured Posts Grid
Affected
up to 1.7
What to do
Affects up to 1.7. Update Featured Posts Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025TabGarb Pro: Cross-Site Request Forgery (CSRF)CVE-2025-28900 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in webgarb TabGarb Pro tabgarb allows Stored XSS.This issue affects TabGarb Pro: from n/a through <= 2.6.
Product
TabGarb Pro
Affected
up to 2.6
What to do
Affects up to 2.6. Update TabGarb Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Custom top bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28895 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through <= 2.1.
Product
Custom top bar
Affected
up to 2.1
What to do
Affects up to 2.1. Update Custom top bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025REST API TO MiniProgram: Cross-Site Request Forgery (CSRF)CVE-2025-28886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects REST API TO MiniProgram: from n/a through <= 5.1.2.
Product
REST API TO MiniProgram
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Bee Layer Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored XSS.This issue affects Bee Layer Slider: from n/a through <= 1.1.
Product
Bee Layer Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update Bee Layer Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Awesome Surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stored XSS.This issue affects Awesome Surveys: from n/a through <= 2.0.10.
Product
Awesome Surveys
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update Awesome Surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28875 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.
Product
BP Email Assign Templates
Affected
up to 1.6
What to do
Affects up to 1.6. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Block Spam By Math Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28871 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
Product
Block Spam By Math Reloaded
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025amoCRM WebForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.
Product
amoCRM WebForm
Affected
up to 1.1
What to do
Affects up to 1.1. Update amoCRM WebForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025ProductDyno: Reflected Cross-Site ScriptingCVE-2024-13413 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is potentially a duplicate of CVE-2025-22320.
Product
ProductDyno
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update ProductDyno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025The WPCS – WordPress Currency Switcher Professional: Arbitrary shortcode executionCVE-2025-2169 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPCS – WordPress Currency Switcher Professional
Affected
up to 1.2.0.4
What to do
Affects up to 1.2.0.4. Update The WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2025-1661 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6.5
What to do
Affects up to 1.3.6.5. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 10, 2025Fresh Framework: Improper Control of Generation of Code ('Code Injection')CVE-2025-26936 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.
Product
Fresh Framework
Affected
up to 1.70.0
What to do
Affects up to 1.70.0. Update Fresh Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2025WC Place Order Without Payment: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26933 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through <= 2.6.7.
Product
WC Place Order Without Payment
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update WC Place Order Without Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2025Massive Dynamic: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26916 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through <= 8.2.
Product
Massive Dynamic
Affected
up to 8.2
What to do
Affects up to 8.2. Update Massive Dynamic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 8, 2025140+ Widgets | Xpro Addons For Elementor – FREE: Stored Cross-Site ScriptingCVE-2024-13649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6.7
What to do
Affects up to 1.4.6.7. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Arbitrary shortcode executionCVE-2025-1325 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rcl_preview_post' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Stored Cross-Site ScriptingCVE-2025-1324 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'public-form' shortcode in all versions up to, and including, 16.26.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: SQL InjectionCVE-2025-1323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Information ExposureCVE-2025-1322 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025Product Input Fields for WooCommerce: Arbitrary file uploadsCVE-2024-13359 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched.
Product
Product Input Fields for WooCommerce
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon: Authentication bypassCVE-2024-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon
Affected
up to 200.3.9
What to do
Affects up to 200.3.9. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record miniorange.com wordfence.com
Mar 5, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Time-based SQL InjectionCVE-2025-1702 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 5, 2025Recently Purchased Products For Woo: Stored Cross-Site ScriptingCVE-2025-1008 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Recently Purchased Products For Woo
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Recently Purchased Products For Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Animation Addons for Elementor Pro: Unauthorized arbitrary plugin installationCVE-2025-1639 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
Product
Animation Addons for Elementor Pro
Affected
up to 1.6
What to do
Affects up to 1.6. Update Animation Addons for Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 3, 2025Flashfader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27279 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lynk Flashfader flashfader allows Reflected XSS.This issue affects Flashfader: from n/a through <= 1.1.1.
Product
Flashfader
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Flashfader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025AcuGIS Leaflet Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Ghedini AcuGIS Leaflet Maps mapfig-premium-leaflet-map-maker allows Reflected XSS.This issue affects AcuGIS Leaflet Maps: from n/a through <= 5.1.1.0.
Product
AcuGIS Leaflet Maps
Affected
up to 5.1.1.0
What to do
Affects up to 5.1.1.0. Update AcuGIS Leaflet Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WOO Codice Fiscale: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27275 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andrew_fisher WOO Codice Fiscale woo-codice-fiscale allows Reflected XSS.This issue affects WOO Codice Fiscale: from n/a through <= 1.6.3.
Product
WOO Codice Fiscale
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update WOO Codice Fiscale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Affiliate Links Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27273 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winking Affiliate Links Manager affiliate-links-manager allows Reflected XSS.This issue affects Affiliate Links Manager: from n/a through <= 1.0.
Product
Affiliate Links Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Affiliate Links Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DB Tables Import/Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27271 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-importexport allows Reflected XSS.This issue affects DB Tables Import/Export: from n/a through <= 1.0.1.
Product
DB Tables Import/Export
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DB Tables Import/Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025.htaccess Login block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27269 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-block allows Reflected XSS.This issue affects .htaccess Login block: from n/a through <= 0.9a.
Product
.htaccess Login block
Affected
up to 0.9a
What to do
Affects up to 0.9a. Update .htaccess Login block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.